Credential-shaped value in a client bundle

How it is detected

Anchored on the assignment rather than the string. A 32-character random token has no distinguishing features — minified JavaScript is full of content hashes and module ids with identical statistics — so the only usable evidence is that the code calls it a key. The value must also pass three independent randomness tests before it is reported.

If you find one

1. 1Revoke the credential with its provider. Rotation is the only fix — the key is in the browser cache, in CDN edge nodes, and in whatever scraped the page.
2. 2Review the account for activity you did not initiate.
3. 3Move the call that needed it to a server route, so the browser never receives the replacement.

Where it turns up

Most often in client bundles built by AI coding tools.