Catalog/VULNERABILITY/api-keys
SCAN-ID: API-KEYSREVISION 2026.4
VULNERABILITYCVSS 9.4 (CRITICAL)

API Key Exposure Scanner

Detect exposed API keys, private tokens, and cloud secrets in client-side bundles and public responses.

Technical Scope & Verification Behavior

Entropy scanning and regex fingerprinting for Stripe live keys, AWS Access Keys, OpenAI tokens, GitHub PATs, and Supabase service role secrets.

Automated Inspection Checks (22)
Passive URL parameter fuzzing
Non-destructive boundary tests
Header & cookie flag assertions
Differential latency timing

Proof of Concept (PoC) Vector

Canonical test payload dispatched during security surface audits.

NEXT_PUBLIC_STRIPE_SECRET_KEY=sk_live_...

Probe Execution Simulator

Watch the probe engine test this signature in an isolated sandbox.

probe-runner (isolated ephemeral container)
Click 'Simulate Check' to watch the headless audit engine test this vector.

Remediation Patch

Environment Variable Isolation

patch.diff (typescript)
--- a/handler.typescript (Vulnerable)
export const stripeKey = process.env.NEXT_PUBLIC_STRIPE_SECRET_KEY;
+++ b/handler.typescript (Remediated)
export const stripeKey = process.env.STRIPE_SECRET_KEY; // Server-only context

Never prefix sensitive private credentials with NEXT_PUBLIC_ or expose them in browser bundles.

AI Agent Prompt (Cursor · Claude · Copilot)

Copy and paste into your editor to refactor this issue automatically.

"Move sensitive secrets from NEXT_PUBLIC_ environment variables to server-only routes or Route Handlers in Next.js."

Run Isolated Check

Test your public domain specifically for API Key Exposure Scanner.

100% passive • No server load

Specification Details

CVSS Score
9.4 / 10.0
Severity Level
CRITICAL
Category
VULNERABILITY
Test Vectors
22 automated
Execution SLA
< 2.5 seconds
False Positive Defense
Strict assertion
Related Standards
#Secrets#Exposure#CWE-798#Cloud

Run continuous monitoring for API Key Exposure Scanner

Audit your site across all 41 vectors automatically on every deploy.

Back to Catalog