Keys that are public on purpose

Some keys are made to sit in a page. They stay safe when the provider side is set up for it.

What it is

Google API keys for maps and Firebase, and Stripe publishable keys, are designed for browser code. A test or development key in a live site is a different matter: it means payments or sign in run on a sandbox.

Why it matters

A public key is only as safe as its restrictions. A Google key without domain and API restrictions lets anyone use your quota and run up your bill. A Stripe test key in production means real visitors reach a payment flow that takes no real money. A live publishable key shows that the app takes payments, which is a fact worth knowing and a reason to keep the rest of the setup tight.

How Tenty checks it

Tenty reads this from the page and the script files every visitor receives. The check runs on every scan, and the finding names the place where the value appears. The finding is informational for keys that are public by design. It rises when a Google key sits next to calls to the Gemini API, and when a test key appears on a host that looks like production.

How to fix it

• Google keys: in Google Cloud, open the key and restrict it to your website addresses and to the APIs the app uses.
• Test keys in production: replace them with the live keys of the same service in the environment of the live deploy.
• Stripe publishable keys: keep them in the page and keep the secret key on your server.

How to reproduce

curl -sS 'https://YOUR-APP/assets/app.js' | grep -o 'AIza[A-Za-z0-9_-]*'

Then try the key from another address to see whether the restrictions hold.