Fix · Vercel and deploying

A secret key appears in my live website's code

UrgentSecurityNot checked against the vendor's current screens

What you may see

Someone says my key is visible in the page source
I used a NEXT_PUBLIC_ or VITE_ name for a secret key

Most likely cause

Variables with the public prefix are copied into the website code that every visitor downloads.

Check first (about two minutes)

Open the live page, view source or the network tab, and search for the start of the key.
Find out what the key can do (read only, or can it spend money or change data?).

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a patient senior engineer who deploys websites on Vercel every day and explains it to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

Menu and button names change over time. If you cannot find a button or page I mention, say so and tell me what to look for instead of guessing.

THE PROBLEM
A secret key appears in my live website's code

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
Variables with the public prefix are copied into the website code that every visitor downloads.

DO THESE STEPS, IN THIS ORDER
1. FIRST: tell me to create a new key at the service and revoke the exposed one, now (do not wait for the code fix).
2. Find every variable with a public prefix and decide which are safe to be public (names of public keys only).
3. Move the secret use to server code (an API route or server action) and read the key from a server-only variable.
4. Redeploy, and check again that the new key is not in the page source.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- A search of the live page source finds none of the secret keys, and the old key no longer works.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not remove features; move the secret use to the server.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

FIRST: tell me to create a new key at the service and revoke the exposed one, now (do not wait for the code fix).
Find every variable with a public prefix and decide which are safe to be public (names of public keys only).
Move the secret use to server code (an API route or server action) and read the key from a server-only variable.
Redeploy, and check again that the new key is not in the page source.

Do not do this

Do not leave the old key active "until later".
Do not paste the key into chat to ask if it is exposed.
Do not remove features; move the secret use to the server.

Try another entry

A secret key appears in my live website's code

What you may see

Most likely cause

Check first (about two minutes)

The fix prompt

Steps

Do not do this

Related

How can we help?