Secrets · exposure
A key that should never leave your server is in everyone's browser
Our free audit found it, or you pressed F12 and searched for `sk_live`. Either way: rotating the key is the first ten minutes, not the fix. The key is in the bundle because something in the browser is calling an API that expects a server, and until that changes the next key leaks too.
Rotate the key today even if you never talk to us. The instructions are on this page.
- First step
- A short call, or a written description if you would rather not talk yet
- Who you speak to
- The engineer who would do the work. No account manager, no sales call.
- Turnaround
- Most single problems are resolved within 48 hours of getting access
- Cost
- Quoted after we have seen it — scope varies, and guessing helps neither of us
How to get this fixed
Already a client? Raise it as a ticket in Golux Club and it enters the queue with an SLA attached.
Why the key is there at all
Generated apps wire the browser straight to whatever service was asked for. That is correct for a Supabase anon key, which is designed to be public and guarded by row-level security. It is wrong for a `service_role` key, which bypasses every policy; wrong for `sk_live`, which can move money; and wrong for an OpenAI or Anthropic key, which can spend it. The mechanism is always the same — a call that needs a secret was written where the secret cannot be kept — so the fix is always the same shape: put a server between them.
How to tell it is this
- `service_role`, `sk_live`, `sk_test`, `sk-proj-`, or `AKIA` appears in the JavaScript you serve
- A `.env` value shows up in the built output because it was named with a client-visible prefix
- Your AI or payment bill has line items you cannot match to a user action
- The key is 'hidden' in a config file or obfuscated — which is not hiding
What we do
Stop the bleeding, then close the hole.
- 01
Rotate, immediately
New key issued, old one revoked, and we check the provider's logs for use you did not authorise. This happens first, before anything else.
- 02
Move the call behind a function
A Supabase edge function or a small API route that holds the secret, validates what it is asked to do, and returns only what the browser needs.
- 03
Lock the door behind it
Authentication on the function, a per-user rate limit, and a spend cap on the provider so a leak or a loop cannot cost you a month's revenue.
- 04
Sweep for the rest
Every other secret in the bundle, the repository history, and the environment variables that are one prefix away from being public.
What you get
- A rotated key, and a bundle with nothing secret in it
- The call working from a function that holds the secret properly
- A rate limit and a spend cap, with the numbers explained
- A list of every other secret we found and where it lives now
When this is not what you need
- The only key in your bundle is a Supabase anon key — that one belongs there; what you need is policies, which is the RLS fix
- You have already been charged for someone else's usage — sort that with the provider first; we can help, but the refund is their process
- Every integration in the app needs this treatment — that is half of the hardening sprint, and better bought that way
How it works
- 01
Tell us the symptom
One paragraph is enough — the error, the screen, what you expected. Run the free audit first if you have not; it often names the problem for you.
- 02
A call, or a written reply
Thirty minutes to look at it together, or a written answer if you prefer. Either way you find out what it is before anything is agreed.
- 03
A written offer
After the call: the scope, the approach and what we need from you. Discussed on the call, confirmed in writing.
- 04
Fixed, explained, handed back
The fix in your project, a short note on what was wrong and why, and how to check it yourself — typically inside 48 hours of getting access.
What we promise before any money changes hands
We tell you what is actually wrong, whether it is one problem or a symptom of a bigger one, and what it would take — before you commit to anything. If the honest answer is that you can fix it yourself in an afternoon, that is the answer you get, and the instructions are usually on this page already.
Questions
- Can I just rotate the key myself and be done?
- Rotate it today — that is the urgent half and you do not need us for it. But the new key goes into the same bundle the old one did, so you are back where you started by the next deploy. The fix is moving the call.
- How do I check my own app right now?
- Open the app, press F12, go to Sources or Network, and search the loaded JavaScript for `service_role`, `sk_live`, `sk-proj-` and `AKIA`. Our free audit does the same thing from outside in about a minute.
- Does an edge function slow the app down?
- By a few tens of milliseconds on the calls that now go through it, which nobody notices, in exchange for a secret that no longer ships to strangers. For AI calls it usually makes things faster, because that is where caching becomes possible.
- What if the key has already been used by someone else?
- We check the provider's usage logs as part of the work and tell you what we find. If there is abuse, rotating stops it; the billing conversation is between you and the provider, and we will write the technical summary they ask for.
Other things we fix at the same price
- Login works, no data shows“I can log in, but every list is empty and there is no error.”
- Payment succeeds, access does not“People pay and the app does not give them what they paid for.”
- It got slow“It was fast with ten rows and it is unusable with ten thousand.”
Next step
Tell us the symptom. We will tell you if it is one problem.
We answer within a few hours with what it is, what it would take, and what we need from you. If it is bigger than one problem, we say that instead — before anything is agreed.
