Vercel
Security & compliance
Releases
Ambiguous key or credential name behind a client-bundle prefix
Part of the Public env exposure check · fix arrives as a guide
What it is
A variable with an ambiguous credential-shaped name — API_KEY, CLIENT_SECRET, or similar — sits behind a client-bundle prefix.
Why it matters
Some keys genuinely belong in the browser and some do not, and the name alone does not settle it. What is certain is that the value is public, so the question is whether that was intended.
How to fix it
Check the provider's documentation for whether this key is publishable. If it is, leave it and note why; if not, move it server-side and rotate it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.