keydrift build leaks repository: why your build ships secrets
Understand why KeyDrift build leaks repository issues happen when build-time inlining ships secrets to visitors while your repo stays clean.
Build-time inlining substitutes literal secret values directly into your JavaScript bundle. The build is what leaks, and a repository scanner cannot see it, meaning your repository can look entirely clean while your production bundle ships sensitive keys to every visitor.
The build‑leak problem: NEXT_PUBLIC_ and VITE_ inlining
Frameworks rely on specific environment variable prefixes to determine how variables are handled during compilation. NEXT_PUBLIC_ and VITE_ prefixes substitute the literal value into the bundle at build time, so the .env file is correctly git-ignored and the key still ships to every visitor. Because the code transformation happens during compilation, the source repository remains clean of secrets, yet the resulting application assets contain credentials that were never meant for the client.
Why repository scanners see nothing
Traditional secret detection tools rely entirely on source code analysis. Nothing is wrong in the repository, which is exactly why repo scanning reports nothing. When a developer inspects the git history or runs a repository scanner, the environment files are properly ignored and the source tree contains no explicit violations. The vulnerability does not exist in the files tracked by version control; it materializes only when the compiler bakes environment variables into the final distribution output.
False positives from generic regex scanners (anon key, Stripe publishable key)
Generic regex tools struggle to differentiate between credentials that belong in the client and secrets that must remain on the server. Meanwhile generic regex scanners flag the anon key and the Stripe publishable key — credentials that are supposed to be there — until the team tunes the whole tool out. This constant noise trains engineers to ignore security warnings altogether, creating a dangerous blind spot for actual high-privilege leaks.
Detecting leaked Supabase, Stripe, OpenAI, and AWS keys in deployed bundles
To find what the repository misses, analysis must shift from source code to distribution output. KeyDrift reads the JavaScript your deployed app actually serves and finds the Supabase, Stripe, OpenAI and AWS keys that should never have left your server. By inspecting the actual runtime artifacts delivered to browsers, it identifies credentials exposed through build-time inclusion.
Intentionally public credentials and how KeyDrift excludes them
Effective detection requires contextual awareness rather than blind pattern matching. KeyDrift features 21 secret detectors, and 3 public credential formats recognised and excluded on purpose — the anon key, the Stripe publishable key and the Firebase web key are meant to be there, and knowing that is what lets KeyDrift say with confidence that the JWT sitting next to them is a service_role key. This precision prevents false positives while flagging genuine risks.
Tool‑shaped leak contexts: Vite SPAs, Cursor edits, Next.js NEXT_PUBLIC_ renames
The leak is tool-shaped: Lovable and Bolt build Vite SPAs with no server to put a key on, Cursor edits the file you have open rather than the architecture, and in Next.js the quickest fix for a build error is the NEXT_PUBLIC_ rename that inlines the secret. Modern development workflows prioritize speed and local functionality, often abstracting away the underlying distinction between server-side execution and client-side distribution.
Running a free KeyDrift scan on your live assets
You can test your deployed assets without creating an account or committing to a paid plan. A free scan at keydrift.dev — no account. Give it a URL or paste a bundle directly. It fetches only deployed public assets, issues GET requests only, and never stores a live key: findings carry a masked prefix and a fingerprint.
Zero live keys stored: how findings are masked and re‑scanned
Security monitoring should not introduce new risk vectors by hoarding sensitive data. 0 live keys stored, ever — findings carry a masked prefix and a fingerprint. KeyDrift re-scans on every push and alerts only when something actually changes. The public scan is free, and the free tier keeps 1 project on daily scans with email alerts. Monitoring is Indie at $19 per 30 days (3 applications, hourly scans, email and Slack, up to 80 chunks per scan) or Team at $39 per 30 days (15 applications, 15-minute scans, email, Slack, Discord and webhooks, up to 150 chunks). One-time payment through Revolut Pro, includes 30 days, does not auto-renew. Findings are never withheld on any plan.
Run a free scan at keydrift.dev by entering your app’s URL or pasting the bundle – no account needed.