Discount-code values appear in client-side code
ShipReady found discount-code-like literals and discount values in published client-side JavaScript.
Why it matters
Anything shipped to a browser can be inspected. Campaign or partner codes placed in client code can become visible before they are intended to be used.
How ShipReady detects it
What it inspects
ShipReady reads page and fetched script text for coupon-named collections or code-and-discount object patterns containing literal codes and discount values.
What triggers a finding
The rule triggers only when it finds both code-like literals and accompanying discount-value signals in one of those supported structures.
What the evidence shows
Published client-side code contains strings that match the scanner's supported discount-code and value patterns.
Limits of this check
ShipReady does not submit a code, inspect server-side redemption rules, or determine whether a code is active, authorized, single-use, expired, or accepted at checkout. The finding does not prove a discount can be redeemed.
How to fix it
Keep discount eligibility on the server
Store campaign rules and code validation in a server-side system, and return only the result needed by the client.
Remove unintended campaign data
Review built JavaScript for old, partner-only, or future promotion values and remove data that does not need to reach visitors.
How to verify the change
Inspect the deployed bundle
Search the deployed client assets for the code and value patterns after release.
Expected: Published assets no longer contain discount tables or rules that should remain private.