Groq API-key pattern appears in public content
ShipReady found a non-placeholder string matching its supported Groq API-key pattern in scanned page or script content.
Why it matters
A real provider credential should be kept out of public browser assets, where visitors can inspect the shipped content.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for its supported Groq gsk_ pattern and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported Groq pattern.
What the evidence shows
The scanner observed a string matching its provider-specific Groq format and records only a redacted prefix.
Limits of this check
ShipReady does not call Groq, verify the value, inspect permissions or billing, or make an inference request. The format match alone does not prove the value is active, usable, or associated with a particular account.
How to fix it
Trace the public asset
Find the source file, environment substitution, or build step that introduced the matched value.
Remove real credentials from browser code
Store confirmed credentials in server-only configuration and prevent them from being inlined into client bundles.
Review confirmed credentials
If the value is confirmed as a real credential, follow the account owner's incident and rotation process.
How to verify the change
Recheck deployed content
Inspect the generated HTML and JavaScript after deployment.
Expected: No unintended string matching ShipReady's supported Groq key pattern remains in public assets.