AI system prompt is hardcoded in the browser bundle

Why it matters

Your client-side JavaScript contains the system prompt for an AI feature. The system prompt is the instruction set and guardrails that govern the model — shipping it to the browser publishes exactly what an attacker needs to craft a jailbreak that bypasses those rules, and any business logic, internal URL, or example data embedded in the prompt leaks along with it. It also almost always means the model call itself runs in the browser, so the provider, model, and often the API key are reachable from the same code. Move the prompt and the model call to a server route; treat anything the prompt revealed as public.

How ShipReady detects it

AI-specific exposure — the product's differentiating module. Covers two distinct failure modes of AI-built applications: 1. Tooling artifacts deployed by accident. AI coding tools generate config and instruction files at the repo root; developers who push a whole repo (rather than just its build output) to static hosting serve them publicly. Some are merely instructions; others hold live API keys. 2. Secrets promoted into the client bundle via a PUBLIC env var prefix. This is the single most characteristic AI-app mistake: AI assistants correctly explain that a variable must be prefixed (NEXT_PUBLIC_, VITE_, ...) to be readable in the browser, and developers apply that prefix to a *server* secret. The bundler then inlines the real value into JavaScript that anyone can read. Both are confirmed by observation, never inferred from framework fingerprints alone.

Detection is deterministic. ShipReady reports this only when it observes the condition directly, and prefers to miss a real problem over inventing one. Rule version 1.7.0.

How to fix it

This is the prompt ShipReady puts in your report — written to be pasted straight into Cursor, Claude Code, or whichever assistant built the app.

Your AI feature's system prompt is hardcoded in client-side JavaScript, so anyone can read it in the page source and use it to craft a jailbreak. Move the model call to a server route (a Next.js route handler, server action, or your backend) and keep the system prompt there, reading it from server-only code — the browser should send the user's input to your route and receive only the response, never see the prompt. Search your frontend for the prompt text, a `systemPrompt`/`SYSTEM_PROMPT` variable, or a `{ role: 'system', content: ... }` message to find it. If the same code shipped the provider API key to the browser, rotate that key too — assume it is compromised.

Frequently asked questions

What does "AI system prompt is hardcoded in the browser bundle" mean?

Your client-side JavaScript contains the system prompt for an AI feature.

How serious is it?

ShipReady rates this medium. Fix soon. Meaningfully weakens a defence or degrades how the site works.

How do I fix it?

Paste the fix prompt on this page into Cursor, Claude Code or your AI editor. It is the same prompt ShipReady puts in your report.

Can I check my own site?

Yes — ShipReady scans up to ten pages of any public site for free and reports this alongside every other check. The free report lists every issue it finds and shows full evidence and a fix prompt for the critical and high-severity ones; medium and low findings are counted and unlock on Pro.

Related checks

• Secret published through a browser-exposed environment variablecritical
• AI provider client is configured to run in the browserhigh
• AI widget missing SRIlow
• AI endpoints are reachable from your client codeinfo
• Exposed AI tooling config that can contain credentialshigh
• MCP server is reachable without authenticationhigh