xAI API-key pattern appears in public content
ShipReady found a non-placeholder string matching its supported xAI API-key pattern in scanned page or script content.
Why it matters
If the matched value is a real API credential, it should be held in server-side configuration instead of public browser content.
How ShipReady detects it
What it inspects
ShipReady scans fetched page content and discovered script content for its supported xAI xai- key format and applies its placeholder guard.
What triggers a finding
The rule triggers when a non-placeholder string matches the supported xAI key pattern.
What the evidence shows
The scanner observed a string matching its xAI-specific format and reports only a redacted prefix.
Limits of this check
ShipReady does not call xAI, validate the value, inspect account ownership or permissions, or make a model request. A format match does not prove that a credential is active, usable, or compromised.
How to fix it
Trace the public value
Identify the source or build configuration that placed the matched string into the deployed asset.
Keep real keys server-side
Remove confirmed credentials from browser code and store them only in server-side secret configuration.
Review confirmed credentials
If investigation confirms a real credential, use the account owner's incident and replacement process.
How to verify the change
Inspect deployed HTML and JavaScript
Search public generated assets after the release.
Expected: No unintended string matching ShipReady's supported xAI key pattern remains in public content.