OpenAI API-key pattern appears in public content
ShipReady found a non-placeholder string matching a supported OpenAI API-key pattern in scanned page or script content.
Why it matters
A real API key should remain server-side because public client assets can be inspected by any visitor.
How ShipReady detects it
What it inspects
ShipReady scans page content and fetched scripts for supported OpenAI key formats and applies format, character-mix, provider-prefix, and placeholder guards.
What triggers a finding
The rule triggers when a non-placeholder string satisfies the supported OpenAI key pattern and guards.
What the evidence shows
The scanner observed a string matching its supported OpenAI API-key format. Reports retain only a redacted prefix.
Limits of this check
ShipReady does not send the value to OpenAI, check its validity, inspect scopes, identify its owner, or make a model request. A format match does not prove the key is active or usable.
How to fix it
Remove the value from public assets
Move server credentials to a server-only secret store and ensure build inputs do not inline them into browser code.
Rotate through the account owner
Treat an uncertain exposed key as requiring review and rotate it using the provider account controls.
How to verify the change
Inspect deployed assets
Search the deployed HTML and JavaScript after release, then confirm server-side configuration uses the replacement secret.
Expected: No unintended OpenAI API-key pattern remains in public assets.