Security finding
A key or password is in the data the framework hands to the browser
Security Error Severity: High
Part of the audit Information exposure. Finding id: security.secretsInHydrationData.
What it costs you
Everything in [marker] is sent to every visitor as part of the page, even when nothing on screen shows it. Whoever reads the page source can use the key with your account.
What to do
Revoke the key and issue a new one now. Then keep it on the server: pass only the values the page displays to the browser.
What it checks
- Secrets inside data sent to the browser
How to fix it
Revoke the key and keep it on the server
- Revoke the key in the service that issued it and create a new one. Treat the old one as known to strangers.
- Find where [key path] is filled: the server-side data function of the page, or a configuration object passed to it whole.
- Pass only the fields the page shows. Read the new key on the server only, from an environment variable that is not exposed to the browser bundle.
How to check: View the source of [example url], find [marker] and look for [key path]: it is gone.