A credential - an API key, access token, password, private key or connection string - is embedded as a literal inside a JavaScript file that the server delivers to every visitor. Anything shipped to the browser is public: viewing the source, opening the developer tools or fetching the script with curl is enough to read it.

Client-side code frequently ends up carrying secrets by accident: a build tool inlines an environment variable that was meant for the server, a developer pastes a key while debugging, or a third-party SDK is initialised with a privileged token instead of a public one.

Impacts:

• Direct use of the key against the third-party service, billed to the application owner
• Access to data the key is authorised for, bypassing the application entirely
• Escalation when the credential belongs to an internal or administrative service
• Long exposure windows, since leaked client-side keys are indexed by search engines and code scrapers

Note that some keys are designed to be public (for example a Google Maps browser key or a Stripe publishable key). Those still need origin, referrer or scope restrictions applied on the provider side, otherwise they can be used from anywhere.

1. Treat the key as compromised. Revoke and rotate it before anything else. Assume it has already been collected.

2. Move the secret to the server. Keep privileged credentials in server-side configuration or a secret manager, and expose a thin proxy endpoint that the browser calls instead. The browser should only ever hold a token scoped to the current user.

3. Use the right key type. Where a provider offers both, ship the publishable or restricted key to the browser and keep the secret key on the server.

4. Constrain what remains. Apply HTTP referrer, origin, IP and scope restrictions to every key that has to reach the client, and give it the shortest useful lifetime.

5. Prevent recurrence. Add secret scanning to the build pipeline and to pre-commit hooks, keep secrets out of bundler environment variables that are inlined into client bundles, and review what the bundle actually contains before release.

• CWE-798: Use of Hard-coded Credentials
• OWASP Top 10 - A07:2021 Identification and Authentication Failures
• OWASP Secrets Management Cheat Sheet