Searching the built bundle rather than the source is the right call, since env variables prefixed for the client get inlined at build time and are easy to miss in code review. Adding a CI step that greps the output folder for common key patterns like sk_live or service_role turns this into a check nobody has to remember. And rotating the key comes before removing it from the code, because the old bundle can stay cached on a CDN for a long time.
Agreed, the built bundle is the only place the truth lives. A CI step that greps dist/ for key prefixes (sk_live_, sb_secret_, AKIA) and fails the build is cheap insurance. Pair it with gitleaks on history, since a key that was ever committed should be treated as leaked.
StackShortlist
Proof Over Promises.
Searching the built bundle rather than the source is the right call, since env variables prefixed for the client get inlined at build time and are easy to miss in code review. Adding a CI step that greps the output folder for common key patterns like sk_live or service_role turns this into a check nobody has to remember. And rotating the key comes before removing it from the code, because the old bundle can stay cached on a CDN for a long time.