Resend API-key pattern appears in public content
ShipReady found a non-placeholder string matching its supported Resend API-key pattern in scanned page or script content.
Why it matters
A real email-provider key should not be delivered to browsers, where it can be independently inspected and copied.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for its supported Resend re_ key format and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported Resend pattern.
What the evidence shows
The scanner observed a string matching its Resend-specific format and retains only a redacted prefix in the report.
Limits of this check
ShipReady does not contact Resend, validate the value, inspect sender identities or account permissions, or send email. The format match does not prove that a key is active, usable, or permitted to send from a domain.
How to fix it
Identify the build source
Trace the public asset to its source or environment configuration and determine whether the value is a real credential.
Move real keys out of client code
Keep confirmed Resend keys in server-only secret storage and ensure browser bundles do not receive them.
Review confirmed credentials
If the value is confirmed as real, review and replace it through the account owner's provider controls.
How to verify the change
Inspect the deployed output
Search public HTML and JavaScript after release.
Expected: No unintended string matching the supported Resend key pattern remains in public assets.