SEV-1: blocks launch

A live secret is sitting in your code

What goes wrong

Someone reads it from your repo or your JavaScript bundle, and the bill or the data breach arrives before you do.

How to fix it

Rotate this key now, because it is already exposed. Move it to a server-side environment variable, read it only from server code, and remove it from the code.

Check your app

npx sigship

Run it in your project. It reports this check as secret-in-code, along with 16 others. Nothing leaves your machine.

See every check