Live secret-key pattern appears in public content
ShipReady found a supported live secret-key pattern in scanned page or script content.
Why it matters
A secret key must not be delivered to browsers; public assets can be retrieved and inspected by anyone.
How ShipReady detects it
What it inspects
ShipReady scans page content and fetched scripts for the supported live secret-key pattern while excluding expected publishable-key patterns and placeholders.
What triggers a finding
The rule triggers when a non-placeholder supported secret-key pattern is found.
What the evidence shows
The scanner observed a string matching the rule's supported secret-key pattern and reports only a short redacted prefix.
Limits of this check
The shared prefix can belong to Stripe or Clerk. ShipReady does not authenticate the key, determine its provider, validate it, inspect permissions, or perform an API operation.
How to fix it
Identify the owning provider
Trace the key through source and deployment configuration to determine which account issued it.
Remove the value and rotate it
Move the replacement into server-only secret management, rotate using the provider account, and remove it from build artifacts.
How to verify the change
Check the deployed output
Search deployed assets for the pattern and validate the application uses the replacement only through server-side code.
Expected: Public assets contain no live secret-key value.