Skip to main content

Secrets

offramp reads secret values in memory to decide whether they are real, and never copies them into the report. Findings cite a file and line instead.

credential.committed​

Critical. A working credential is committed to the repository: a value in a .env file, a connection string with a password in it, or a service_role key or live secret key written into server-side code such as an edge function or a seed script.

Anyone who can read the repository can use it. Deleting the file later does not help, because the value stays in the git history.

It is not reported when the value is a template or placeholder (your_api_key_here, <password>), a setting that is not a secret (TOKEN_EXPIRY=24h), a key that is public by design, or in a template file such as .env.example.

Fix: rotate the credential at its source, then supply the new value through the environment rather than a committed file. Treat the old value as disclosed.

frontend.secret_in_bundle​

A secret shipped to every browser. Build-time variables that start with VITE_, REACT_APP_ or NEXT_PUBLIC_ are compiled into the JavaScript that every visitor downloads, so anyone can read them.

  • High when frontend code reads a build-time variable whose name says it is a secret, such as VITE_OPENAI_API_KEY. The value may not be in the repository, because it can be set in the platform's dashboard, so the report asks you to confirm.
  • Critical when the value itself proves it: a Supabase key whose role is service_role, which bypasses every row-level-security policy, or a literal in a known secret-key format, written into code that ships to the browser.

Server-side directories such as supabase/functions/, api/, server/ and scripts/, and test files, are not counted as shipped to the browser. A secret there is reported by credential.committed instead, so nothing is reported twice.

Fix: revoke the key and issue a new one. Move the call that needs it behind a server-side function. Rebuilding with a new value does not help, because the new value is baked into the new bundle too.

What these checks cannot see​

A secret removed in a later commit is still in the git history, and offramp reads only the files as they are now. Run a history-wide secret scanner such as gitleaks or trufflehog. Secrets set in the platform's dashboard are not in the repository at all. See what offramp cannot see.