Scan public JavaScript for exposed secrets

What the scanner does

Review the code browsers receive after deployment.

Every browser can download your public JavaScript. SiteGuardrail reviews completed first-party script coverage for high-signal secret patterns and suspicious assignments, then returns redacted evidence, an affected URL, confidence, risk, and remediation. It never sends a detected value to its provider or attempts to authenticate with it.

Pattern matching can produce false positives. A finding means “review this value and context,” not “this credential has been proven valid.”

Public versus secret

Not every API-looking value belongs on the server.

Fix the deployment path

Move privileged operations behind a server boundary.

Client-prefixed environment variables are public by design. In Next.js, values deliberately bundled for the browser must use a public boundary such as NEXT_PUBLIC_; in Vite, client code can access exposed VITE_ values. Renaming a secret does not make it safe—keep privileged values out of the client build entirely.

// Browser code calls your server route
await fetch("/api/create-payment", {
  method: "POST",
  headers: { "content-type": "application/json" },
  body: JSON.stringify({ planId }),
})

// The server route reads the secret from server-only configuration

If a real secret was shipped

Treat the deployed value as compromised.

1. Remove it from the client bundle and deploy the corrected boundary.
2. Revoke or rotate the old credential at the provider.
3. Review provider and application logs for unexpected use.
4. Reduce the replacement credential's permissions and lifetime.
5. Purge cached assets, then rerun the checker.