Secret keys in your Base44 app’s code
Anything your front end uses, every visitor can read. Some keys are made for that; others let whoever has them spend your money or read your data.
What usually causes it
Keys pasted into the code
A key put straight into a component or a config file ships to every browser, and stays in the repository’s history after it is removed.
Secrets in VITE_ variables
Vite puts every variable whose name starts with VITE_ into the code the browser downloads. That is right for a public key and wrong for a secret one.
A committed .env file
An .env file in the repository puts every secret in it in the hands of anyone who can see the code.
What to check yourself
- Know which keys are public by design: a Supabase anon key or a Stripe publishable key is; a service role key, a Stripe secret key or an OpenAI key is not.
- Search your code for the secret ones. Base44 can export your app’s code to GitHub.
- Replace any secret key that was ever in the code with a new one, then keep it on a server: deleting it from the code is not enough.
What the free scan looks at
The scan looks through your code for committed .env files and for Stripe, OpenAI, Anthropic, AWS, GitHub and Supabase service role keys, including secrets in VITE_ variables, and reports what it finds without showing the keys themselves.
If you’d rather we fix it
App Rescue moves the secrets out of the browser and into server functions, tells you which keys to replace and how, and checks that nothing secret is left in what the browser downloads. Production Ready covers the rest of the security checklist.
App Rescue, from €299 + VAT for a small app. The scan works out the exact price for yours.