Find exposed API keys in code and respond to a leak

Use local secret-pattern checks, separate public identifiers from credentials, and rotate exposed keys before cleaning up code and history.

Choose the right input boundary

For a short excerpt, use the browser Secret Scanner: it checks pasted content locally without sending it to the scanner server. The main Pasted code scan is a separate, server-processed workflow. For a repository, use the public repository mode with sign-in and a configured backend. Do not assume all three modes have the same privacy properties or coverage.

Review matches without spreading the secret

Use a synthetic configuration to learn the tool first. For each real match, identify the provider, intended exposure and privileges privately. Pattern detection can flag examples or miss unusual formats. Some public client identifiers are designed to be exposed, while service credentials must stay on the server. Never validate a discovered credential against an unrelated account or service without authorisation.

Rotate before removing

If a privileged key was public, revoke or rotate it using the provider’s controls. Update the server environment and redeploy the application, then confirm the old credential is rejected in your authorised environment. Review the provider’s access logs and permissions. Deleting a source line or changing a repository to private does not invalidate copies that have already been downloaded.

Inspect the places a key can survive

Check built JavaScript, source maps, configuration, logs, CI outputs and git history. A public repository scan can include history and enabled secret engines; skipped engines are a coverage gap. Removing history may disrupt collaborators, so coordinate cleanup after revocation. Keep credentials out of NEXT_PUBLIC variables and other frontend build substitutions when they must remain private.

Prevent the next exposure

Store server credentials in environment settings with narrowly scoped privileges. Commit an example environment file containing placeholders, and add local secret checks before commits and CI checks before deployment. Review the report after remediation and document any skipped checks. A clean pattern scan cannot guarantee that the code contains no secrets.