Anthropic API-key pattern appears in public content
ShipReady found a non-placeholder string matching its supported Anthropic API-key pattern in scanned page or script content.
Why it matters
If the matched value is a live credential, it belongs in server-side configuration rather than a public client asset.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for its supported Anthropic key format, while applying its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported sk-ant-api Anthropic pattern.
What the evidence shows
The scanner observed a string matching its Anthropic-specific format and retains only a redacted prefix in the report.
Limits of this check
ShipReady does not submit the value to Anthropic, validate it, inspect its owner or permissions, or make a model request. A format match does not establish that a credential is active, usable, or compromised.
How to fix it
Locate the matched value
Trace the reported public asset back to its source or build input and determine whether it is an unintended credential, a test value, or an example.
Keep credentials out of client assets
Move any real credential to server-only configuration, then remove it from generated browser assets and build inputs.
Review the provider account if needed
If the value is confirmed as a real account credential, use the account owner's incident and rotation process.
How to verify the change
Inspect the deployed assets
After release, search the deployed HTML and JavaScript that ShipReady can fetch.
Expected: No unintended string matching the supported Anthropic key pattern remains in public content.