Everything your application hands the browser is public, whatever the variable was called. The question is never whether somebody could read it; it is which of your credentials went out and what each one is permitted to do.
Nothing, until an invoice arrives for usage you cannot account for, a provider suspends you for abuse, or a stranger emails to say they found a credential in your site. The value is sitting in the JavaScript your domain serves, and reading it takes a browser the visitor already has open.
A call needed a credential, the credential was not available where that code was running, and the shortest path past the error was to mark the value as public so the build would accept it. Bundlers make that a one-word change. Sometimes the value was pasted directly into a component instead. Either way the build now treats it as content to ship, and it leaves with every page.
We read the built output rather than your source, because what ships is the only thing that counts, and match anything credential-shaped in it against the providers you use. Then we pull each provider's own activity record to see whether that credential has been used from addresses that are not yours, which is the line between an exposure and an incident.
Rotation first, on everything that went out, before anything else is tidied. Then the calls that needed those values move to the server, so the browser asks your application and your application holds the credential. Where a provider does publish a browser-side value on purpose, it gets restricted by domain and by permission instead, so the public half can do only the one thing it exists for.
$199$349promo
You send a link, a repo, or both. We reproduce the problem, read the code, and record a short walkthrough: what's broken, why it broke, and what it takes to fix. You get written findings and a fixed quote.
Book my auditPriced after the audit
Scoped from the audit and agreed before anything starts. We fix the cause rather than the symptom, and hand back something maintainable, with a written note on what changed and why.
Nobody can price this honestly before seeing the code. The audit is what makes a firm number possible.
The audit is a fixed price and you know it before you pay. Everything after it is quoted from what the audit actually found, and you approve the number before any work starts.
What we can show you is who does the work, what it costs, and how well we already know the failure you are staring at.
This is run by a small web agency. The person who records your audit is the person who does the fix, so you're not being routed to an anonymous bidder.
$199$349promo
Plenty of people take the findings and do the work themselves, or hand them to their own developer. That is a fine outcome and nothing is bundled to stop it.
Book my auditYou approve a number before work starts. If the job turns out harder than we estimated, that's ours to absorb, not a change order.
Security is the part an AI builder is quietest about. None of these stop the app working, which is exactly why they ship.
If you recognised your own problem somewhere above, that is the point. The audit is where you find out which one it actually is.
$199$349promo
One fixed-price audit at $199 instead of $349. A video walkthrough, written findings and a firm quote on what it takes to fix.