Why it matters
A secret key in the browser is a public key. People run scanners for exactly this, and a leaked OpenAI or Anthropic key can run up a large bill within hours. A Stripe secret key or a Supabase service_role key is worse: it gives full access to your payments or your whole database, bypassing every security rule you set.
How Patch checks
We download the JavaScript your pages load (up to 5 MB) and search it for the formats of OpenAI, Anthropic, Stripe secret and restricted, AWS, GitHub, SendGrid, Resend and Twilio keys. For Supabase we decode each JSON web token and check its role: the public "anon" key is fine, "service_role" is not. We only show a masked version of what we find.
How to fix it
- Rotate the exposed key now, in that provider's dashboard. Assume the old one has been copied.
- Move the code that uses it to a server function (a Supabase Edge Function, a Vercel or Netlify function, or your own API) and keep the key in an environment variable there.
- Call that function from the browser instead.
- Search your code and git history for the old key, and check the provider's usage logs for anything you didn't do.
Your own report goes further: it names the exact pages, services and settings Patch found on your site, and with a full report you get a fix prompt to paste into Lovable, Bolt or Cursor.
Where this applies
Good security practice everywhere. Where personal data is at risk, GDPR and UK GDPR also require appropriate security.