A Secret API Key Is Exposed in the Frontend of a Lovable App
Quick Answer
A server-only secret was placed in client-side code, a NEXT_PUBLIC variable, or a browser fetch call. Once bundled into the frontend, it is effectively public. Start with "Rotate the leaked key immediately" before making broader code changes.
Quick Fix Summary
| Most likely cause | A server-only secret was placed in client-side code, a NEXT_PUBLIC variable, or a browser fetch call. Once bundled into the frontend, it is effectively public. |
| Fastest fix | Rotate the leaked key immediately |
| Use this page if | You can see a secret key in the browser source or network tab |
You're in the right place if...
- !You can see a secret key in the browser source or network tab
- !A key starting with sk_, service_role, or Bearer is shipped to the client
- !Abuse or unexpected API usage appears after launch
Why this happens
A server-only secret was placed in client-side code, a NEXT_PUBLIC variable, or a browser fetch call. Once bundled into the frontend, it is effectively public.
Fix
Rotate the leaked key immediately
Do not leave the exposed key active. Create a replacement in the provider dashboard, update the server-side secret, and revoke the leaked one.
Move the API call behind a server route
Any request needing a secret belongs in an API route, Edge Function, or backend action that the browser calls indirectly.
Audit env variable prefixes
Anything prefixed with NEXT_PUBLIC_ is exposed to the browser. Keep only genuinely public values there.
// Safe in browser: NEXT_PUBLIC_SUPABASE_URL=... // Never in browser: STRIPE_SECRET_KEY=... SUPABASE_SERVICE_ROLE_KEY=... OPENAI_API_KEY=...
Patch the generated code path
Tell Lovable to move all secret-bearing calls out of the frontend.
Copy this prompt
Audit this app for any secret keys, bearer tokens, service role keys, or provider SDK calls that run in the browser. Move them to secure server-side routes and update the frontend to call those routes instead.
Prevent this next time
If a value can spend money, bypass auth, or write privileged data, it does not belong in client code.
Frequently Asked Questions
Yes, if your RLS policies are correct. It is designed for client use. Service role keys are not.
Yes. Once a secret was exposed in the browser, logs, or Git history, assume it is compromised.
Related fixes
Weekly Signals
Get the next fix, switch, or warning before it hits your build.
Join builders getting the community signals, fix patterns, and tool shifts that matter before they show up everywhere else.
Follow the signals →