Why JS Secrets are Dangerous

Developers often hardcode API keys (like Google Maps API, Stripe Public Keys, or even AWS Secret Keys) directly into frontend JavaScript files for convenience. However, anything in client-side JS is public.

What We Look For

• Google API Keys: Can be abused to generate thousands of dollars in usage bills.
• AWS Access Keys: Might grant full access to your S3 buckets or EC2 instances if permissions are loose.
• Email Addresses: Scraped by spammers for phishing campaigns.
• Firebase Configs: Often expose real-time databases to unauthorized reads/writes.

Remediation

Move sensitive logic to the backend. Use environment variables (.env) and never commit secrets to Git. For public keys (like Maps or Stripe), ensure they are restricted by HTTP Referrer in the provider's console.