Browser bundle contains a supported AI-client browser configuration signal
ShipReady found the supported minified dangerouslyAllowBrowser configuration pattern in client content and did not find a nearby relative or same-origin baseURL signal that would suppress this rule.
Why it matters
A browser-configured AI client deserves a review of where requests are routed and which configuration values are intentionally available to client code.
How ShipReady detects it
What it inspects
ShipReady searches the captured page HTML and fetched JavaScript for the supported minified dangerouslyAllowBrowser:!0 pattern. It does not extract or retain API-key values.
Around a match, ShipReady checks a bounded 400-character window for a relative or same-origin baseURL and suppresses the rule when it finds one.
What triggers a finding
The rule triggers when the supported minified pattern is present and no relative or same-origin baseURL is found in the configured window around it.
What the evidence shows
The inspected client content contains ShipReady's supported browser-client configuration signal without the rule's nearby first-party-proxy suppression signal.
Limits of this check
ShipReady does not prove that an API key exists, is exposed, valid, usable, or used. It does not send requests to an AI provider, inspect provider configuration, or determine runtime request behavior. The unminified true form is intentionally not reported to avoid matching SDK example text.
How to fix it
Trace the browser client configuration
Identify the code that creates the AI client and confirm whether requests are intended to go directly to a provider or through a first-party service.
Keep confidential configuration server-side
Review build inputs and client code so confidential provider configuration is available only to trusted server-side code when that matches the product's design.
How to verify the change
Inspect the deployed client build
Search the deployed HTML and JavaScript for the reported configuration pattern and review the associated baseURL and request path.
Expected: The deployed client configuration matches the intended server and provider boundary.