Static exports and SPAs: there is no server to hide anything
Pure front-end deployments cannot hold server secrets, period. Learn the proxy pattern; confirm your build is clean — free.
Some stacks make the boundary obvious by removing the server entirely. Static exports, SPA hosting, CDN-only deploys: every byte served is public by construction.
Architectural honesty, then the proxy options ranked by effort.
The architectural truth
There is no private context to configure. Any value present in build output is readable, copyable, reusable. The question is never “how do I hide it?” but “which server-less-adjacent context can hold it?”
Denial, briefly
Most teams cycle through disbelief — surely the framework handles this? Frameworks handle bundling; physics handles the rest. The faster you accept the constraint, the cheaper the fix.
Where secrets can actually live
- Edge/serverless functions on the same host (Vercel/Netlify/Cloudflare functions) holding provider keys in their own env.
- BaaS edge functions (Supabase/Deno-style) for database-adjacent work.
- A tiny dedicated proxy service when hosts offer none.
Minimal working shape
// /functions/submit.ts (host-provided)
export async function onRequestPost({ env, request }) {
const r = await fetch(PROVIDER, {
method: "POST",
headers: { Authorization: `Bearer ${env.PROVIDER_KEY}` },
body: request.body,
});
return new Response(r.body, { status: r.status });
}Verify the export itself
Search dist/ for every provider marker before deploy — and after, since CI injection surprises. A free scan of the final URL settles it in seconds.
Why this failure class persists
Zoom out and the pattern is bigger than one repo. AI-assisted output has outgrown review capacity everywhere at once, which means thousands of teams are making the same reasonable-looking tradeoffs in the same week. Nobody using modern tooling is uniquely exposed. The failure mode documented above is the modal outcome of velocity without verification, not evidence of carelessness.
How KeyDrift reports this exact finding
Report anatomy matters during incidents, so it is worth reading once calmly: masked string (never the live value — it ceases to exist outside the detection engine), salted fingerprint (trackable within your workspace, useless to strangers), chunk path (your starting point for a "git log -S" hunt), disposition (secret versus public-by-design), confidence (matches below 0.5 never reach the page at all).
Manual check, step by step
The full manual drill, for readers who want zero dependence on any tool: open the deployed site in a private window; launch DevTools → Sources; use Search-all-files (Ctrl/Cmd+Shift+F) for eyJ; then repeat for the other marker families — eyJ, sk_live_, sk-proj-, AKIA, postgres, BEGIN PRIVATE KEY. Decode anything JWT-shaped before reacting, and classify public-by-design formats as expected guests rather than intruders.
Close the loop with monitoring
If you take one operational step from this page, make it this: put the URL under continuous monitoring (free tier covers one project daily). The first scan tells you whether you have a problem today; the schedule tells you whether the problem comes back next month after someone re-adds the convenient line.
What the plans change
- Free $0 — 1 project · daily scans · email alerts · findings always visible.
- Indie $29/mo — 3 projects · hourly · Slack added · 80 chunks per scan.
- Team $89/mo — 15 projects · every 15 minutes · Discord + webhooks · 150 chunks.
- Growth — from $249/mo, quoted display-only until checkout ships.
The constant across every tier: plans limit how much is watched, never what a scan found. Visibility is structural, not promotional — asserted by tests over the entitlements model itself.
Common questions
Env vars at host dashboard — safe?
Safe for functions’ runtime; unsafe the moment referenced from bundled frontend code.
SSR migration the real fix?
Often, eventually. Until then, functions bridge cleanly.
Run a free scan at keydrift.dev/scan — paste a URL or the bundle source itself, no account. Findings arrive masked, with the exact chunk they live in.