Skip to content
BuildThenTestedSee packages
CriticalSecrets and keys

Secrets committed to the code repository

Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted. API keys and passwords the app uses to talk to other services. Check it yourself with the steps below; our test adds what a script and a second account can find.

What it looks like

# .env  (tracked by git)
DATABASE_URL=postgres://postgres:P4ssw0rd...@db.abcd1234.supabase.co:5432/postgres
STRIPE_SECRET_KEY=sk_live_...
OPENAI_API_KEY=sk-proj-...

# .gitignore
node_modules/
An environment file holding live credentials, with a .gitignore that does not exclude it, so every key is stored in the project's history.

What happens

Everyone who can see the repository, now or later, holds working keys to the database, payment account and model provider, and the keys stay in history after the file is deleted.

Where it shows up

Descriptive, not a verdict: builders and stacks whose defaults make this reachable, or that a public incident names. Each hub states the tool's own security features.

Seen in public

Lovable reported that from 3 February to 20 April 2026 a backend regression let any logged-in Lovable user read the chat history and source code of public projects; a fix shipped within two hours.

  • 2026-02-03 to 2026-04-20 Exposure window
  • 2026-02-22 First HackerOne report
  • about 2 hours Time from public report to fix

Apr 2026 · Lovable · all sources

Escape analysed more than 5,600 publicly deployed apps built with AI app builders and found more than 2,000 vulnerabilities, over 400 exposed secrets and 175 instances of exposed personal data.

  • more than 5,600 Apps analysed
  • more than 2,000 Vulnerabilities found
  • 400+ Exposed secrets
  • 175 Exposed PII instances

Oct 2025 · Escape · all sources

Check it yourself

Uses your builder's dashboard and your browser. No tools to install.

  1. Open your project on GitHub (or the code view in your builder) and look at the file list for .env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.
  2. Use the repository search box and search for sk_live, sk-, service_role, BEGIN PRIVATE KEY and password=.
  3. If you have the code on your computer, run one command in the project folder: git log --all -p -S sk_live -- . | head. Any output means a live key has been committed at some point.
  4. On GitHub, open Settings, then Code security, and check whether Secret scanning shows alerts.
  5. A bad result is any env or key file in the file list, any search hit that shows a real key, or an open secret scanning alert.

What we check

We scan the full commit history, not just the current files, with pattern and entropy detection, then check each finding against the issuing service to see whether it still works. The report lists each live key, the commit it first appeared in and what it grants.

Fix direction

Rotate every key that was ever committed, because history keeps them even after the file is removed. Add env and key files to .gitignore, store live values in the hosting provider's environment settings, and turn on GitHub secret scanning and push protection, which are free for public repositories.

Mechanism documented in: About secret scanning (verified 2026-09-21); Removing sensitive data from a repository (verified 2026-09-21).

Covered by

Pre-launch check ($490, 48 hours) and Security sweep ($290, 24 hours)

Both include a re-check after your fixes.

Compare packages

Related patterns

  • NEXT_PUBLIC_ prefix on a secretSecrets and keys

    The build writes the secret's value into public JavaScript, so anyone who loads the site can read it, and a redeploy with the same variable name republishes it.

    Critical
  • Builder project set to publicDeploy and config

    Everything you and the assistant wrote to each other, including pasted keys, customer details and unpublished code, can be read and copied by strangers on the same platform.

    High
  • Third-party API key in the JavaScript bundleSecrets and keys

    Anyone who views the page source can take the key and run up charges, send messages or pull data on your account until the key is revoked.

    High
  • Stripe test keys in productionPayments

    Customers can pay with Stripe's published test card numbers, the app fulfils the order, and no money ever reaches your account.

    High

Questions

i accidentally committed my env file to github what should i do

Rotate every key in the file first: GitHub's own guidance says a committed secret should be treated as compromised and revoked before anything else. Then add the file to .gitignore and move the values into your hosting provider's environment settings. Rewriting git history is optional once the old keys no longer work, and it is hard to do cleanly across forks and clones.

does deleting a file from git remove the secret

No. Deleting the file in a new commit leaves the old version in the repository history, where anyone with read access can still find it. The reliable fix is to revoke the key at the provider and issue a new one. Removing it from history is a separate, optional clean-up step.

does github check for leaked secrets automatically

For public repositories, GitHub runs secret scanning for free and notifies partner services so they can revoke the credential. Push protection, which blocks a push that contains a recognised secret, is also available at no cost for individual users on GitHub.com. Private repositories need a paid plan for these features, so check your project's Code security settings.

Back to the catalogue, or run the self-check for your stack.