Source code
Security & compliance
API-key exposure
Part of the Email safety check · fix arrives as a guide
What it is
The email provider's API key is reachable from client-side code, or committed to the repository.
Why it matters
The key is authority to send as your domain. Whoever finds it can run a phishing campaign from your verified sender, and the reputation damage outlasts the rotation.
How to fix it
Rotate the key immediately — treat it as compromised — and move sending behind a server-side endpoint. The browser should call your API, never the mail provider directly.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.