SendGrid API-key pattern appears in public content
ShipReady found a non-placeholder string matching its supported SendGrid API-key pattern in scanned page or script content.
Why it matters
A real email-service credential should remain in server-side configuration rather than a browser-delivered asset.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for the supported two-part SendGrid SG. key format and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches ShipReady's supported SendGrid key pattern.
What the evidence shows
The scanner observed a string matching its SendGrid-specific format and stores only a redacted prefix in evidence.
Limits of this check
ShipReady does not authenticate to SendGrid, validate the value, inspect scopes, verify sender identities, or send email. The static format match does not prove that the key is active or can send from any domain.
How to fix it
Trace the matched value
Locate the source and build input that included the value in public content.
Keep confirmed keys server-side
Remove real SendGrid keys from browser bundles and provide them only to trusted server-side code through secret storage.
Review confirmed credentials
If the value is confirmed as real, review and replace it with the account owner's SendGrid controls.
How to verify the change
Search deployed assets
Inspect the deployed HTML and JavaScript after the update.
Expected: No unintended string matching the supported SendGrid key pattern remains in public content.