Review page source, browser JavaScript, and Git history for exposed API keys, passwords, and tokens. Identify potential leaks and guide fixes, including moving secrets to the server, replacing compromised credentials, and adding checks before commits.
Use when reviewing client-side JavaScript, HTML source, or git history for exposed credentials, API keys, or tokens.
Checks HTML and JavaScript delivered to browsers, along with Git history, for exposed API keys, tokens, passwords, private keys, and connection strings. It looks for possible leaks using clues such as key prefixes and encoded strings in unexpected places. It also explains how to move credentials to the server and change external API calls so they go through the server.
Use it when reviewing a frontend before release or investigating credentials that may have been committed accidentally. Alongside fixing exposed secrets, it helps organize prevention measures: detection with GitLeaks, TruffleHog, or GitHub Secret Scanning, and checks before commits.
Treat secrets in code delivered to browsers as public. Remove exposed credentials from the code and replace them promptly; removal alone is insufficient. The skill also advises against putting secrets in Next.js variables prefixed with NEXT_PUBLIC_.
This overview was written by AI (OpenAI Codex) from the public SKILL.md. Check the original below for the exact behavior.
AI rated this skill on four points using only the contents of its SKILL.md. Stars and popularity are not taken into account.
The total counts each point as A = 25, B = 15, C = 5. Rated by AI (OpenAI Codex) as of Oct 23, 2026. Treat it as a guide and read the original before installing.
Review the instructions the agent will receive before you install.
An API key embedded in client-side JavaScript gives anyone with a browser devtools tab full access to your cloud services, databases, or third-party APIs — leading to data breaches, unexpected charges, or account takeover.
NEXT_PUBLIC_ are exposed to the browser — never put secrets in these.env files committed to git, hardcoded API keys in JS bundles, service account credentials in window.__INITIAL_STATE__git log -S 'keyword' to search git history for previously committed secrets; rotate any found secrets immediatelyScan the page HTML source and JavaScript bundles for patterns that look like secrets: API keys, tokens, passwords, private keys, connection strings, or credentials. Check for common patterns like sk_, pk_, AIza, ghp_, AKIA, and base64-encoded strings in unusual contexts.
Move all secrets server-side. Replace client-exposed credentials with server-side API proxies. Rotate any leaked credentials immediately — treat them as compromised. Implement git-secrets or a pre-commit hook to prevent future leaks.
Explain why client-side JavaScript is public code, how secrets leak into bundles, what the impact of a leaked API key is, and how to architect applications to keep secrets server-side.
Review server config, headers, forms, and integration points related to Leaked Environment Variables. Flag exact responses, cookies, or browser behaviors that violate the rule, and verify them against the effective production-like response.
For full implementation details, code examples, and framework-specific guidance,
see references/rule.md.
Rule page: https://frontendchecklist.io/rules/security/leaked-secrets
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Create and review custom 404 pages that help visitors recover from broken or moved links through search and navigation. Check the rendered page and HTTP response so missing content returns a proper 404 status.
Audit or create a dedicated About page that explains a website’s purpose and identifies its people or organization. Review the rendered output and supporting information, including expertise and contact details, to find gaps.
Review and add automated accessibility checks for components, pages, and continuous integration workflows. Use axe-based tools to detect structural and attribute issues, while identifying checks that still need keyboard or screen reader testing.
Review sign-in, registration, multi-factor authentication, and account recovery for accessibility barriers. Find blocked paste, difficult code entry, and inaccessible backup methods, then suggest authentication paths that support password managers, autofill, or device approval.
Review form errors, success messages, and live updates so screen reader users receive important notifications. Check the HTML delivered to the browser, announcement settings, display duration, and dismissal controls, then identify specific elements that need changes.
Review HTML tables so screen reader users can understand how headers and data relate. Check header markup, table descriptions, and merged cells, then identify specific fixes and ways to verify them.