Perplexity API-key pattern appears in public content
ShipReady found a non-placeholder string matching its supported Perplexity API-key pattern in scanned page or script content.
Why it matters
Real API credentials should not be shipped to browsers, where the public asset can be inspected independently of the application UI.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for its supported Perplexity pplx- pattern and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported Perplexity pattern.
What the evidence shows
The scanner observed a string matching its Perplexity-specific format and reports only a redacted prefix.
Limits of this check
ShipReady does not contact Perplexity, validate the value, determine its account, inspect billing or limits, or make an API request. The format match does not prove that it is active, usable, or charged to an account.
How to fix it
Trace the matched string
Find the source and build input that placed the value in a public asset.
Relocate real credentials
Keep confirmed API keys in server-only secret storage and avoid exposing them to browser bundles.
Review confirmed account credentials
If investigation confirms a real key, use the account owner's credential-management process to review and replace it.
How to verify the change
Inspect deployed public content
Search the deployed HTML and JavaScript after the update.
Expected: No unintended string matching ShipReady's supported Perplexity key pattern remains in public assets.