Publish without exposing secrets
Learn which values are safe in a browser and which must remain on the server.
What you will finish
Deploy a website without putting private keys, passwords or confidential data into public files or browser code.
Step by step
- 01
Classify each key
Public configuration may be visible in the browser. Service-role keys, private API keys and passwords must stay in protected server settings.
- 02
Search before publishing
Search the project for key names, passwords, tokens, private URLs and copied customer data.
- 03
Use host settings
Store server secrets in the hosting provider's environment settings. Do not paste them into public source files.
- 04
Restrict database access
Enable row-level security and write rules that limit each signed-in user to the records they should see or change.
- 05
Assume leaked secrets are compromised
If a private key was committed or shown in the browser, rotate it. Removing it from the latest file is not enough.
Use this as a starting point
Audit this website for exposed secrets. List every environment variable and say whether it is intended for the browser or server. Find hard-coded tokens, passwords, private keys, service-role keys and personal data. Check whether database access rules protect each table. Do not print full secret values in your answer.Replace the bracketed notes with your own facts. Read the answer before using it.
Watch for these
- Treating a hidden input as secret
- Putting a service-role key in a browser variable
- Assuming a private repository makes leaked keys safe
- Creating database tables without access rules
Before you continue
- No private key is in browser code
- Server secrets are stored by the host
- Database rules are enabled
- Leaked keys were rotated
- Test data contains no real personal data