A browser downloads your public application code. If a privileged credential is included in that code, hiding it behind a button or renaming the variable does not make it private.
What a public-file key scan checks.
StackSnack looks for credential patterns in reachable HTML, JavaScript, and available source-map content. Findings include masked evidence, severity, an explanation, a recommended fix, and a builder prompt. The report is private to the browser that created it, and can be downloaded as text, Markdown, JSON, or CSV.
Pattern matching has limits: it can miss unfamiliar formats, dynamically assembled values, files that were not discovered, and code behind authentication. A detected string also needs context; not every key-shaped value is a secret.
Public configuration is different from a secret.
A Supabase publishable/anon key or Firebase client configuration can be intended for the browser. Access rules must still protect the underlying data. A Supabase service-role key, payment secret, email-provider token, or model-provider secret has a different privilege boundary and should not be shipped to clients.
Finding a public configuration value does not authorize database testing. Read the scope notes in the Supabase RLS checker and Firebase rules checker.
If you discover an exposed credential.
- Confirm the credential’s purpose and privilege with its provider.
- Revoke or rotate the exposed credential at the provider; removing it from a bundle does not revoke an already copied value.
- Move privileged requests to a trusted server with appropriate authorization.
- Review deployment artifacts, repository history, provider logs, and permissions for exposure or misuse.
- Publish the reviewed change and rescan the public surface. Follow your provider’s incident-response guidance.
Never paste a real secret into a public issue, feedback form, or chat to ask whether it is exposed. Use masked evidence and keep investigation records private.
Continue with the AI app launch checklist. StackSnack covers a limited set of checks and cannot guarantee that every credential or vulnerability will be found.
Take a free scan before the next deploy.
Use a public web page you own or have explicit permission to test. Reports stay private to the creating browser. Scans, full reports and fix prompts are always free.
Start my security scan ↗Website verification enables deeper file checks. Backend tests need separate ownership approval. A clean result cannot guarantee security.