Mapbox secret token

How it is detected

Matches `sk.` followed by a JWT. Only `pk.` tokens belong in a browser; an `sk.` token can create and delete tokens on the account.

If you find one

1. 1Revoke the credential with its provider. Rotation is the only fix — the key is in the browser cache, in CDN edge nodes, and in whatever scraped the page.
2. 2Review the account for activity you did not initiate.
3. 3Move the call that needed it to a server route, so the browser never receives the replacement.

Where it turns up

Most often in client bundles built by AI coding tools.