A pen tester in Austin looked at my API keys and said 'you know these are just sitting in the JS bundle, right?'

Drew Garcia · 2026-09-30T17:15:03.198008+00:00

He pulled up dev tools on my own login page and there were 3 live keys in plain sight, so now every key goes behind a proxy and I check bundles before every deploy, has anyone else had a client call them out like that?

Talk Freely

Loading…

A pen tester in Austin looked at my API keys and said 'you know these are just sitting in the JS bundle, right?' | Api Security - Talk Freely