Guide
Is a secret key or admin page visible on my live app?
Updated
Your live app sends its code to every visitor's browser. If a secret key or an unprotected admin page ends up in that code, anyone who looks can use it: to read your customers' data, change it, or run up charges on your accounts. You will not see it happen.
Why it happens
Publishable keys are made for the browser. Secret keys, such as Stripe secret or restricted keys and Supabase secret or service keys, bypass the protections and must stay on a server.
Possible causes
- A secret key was placed in front-end code instead of a server-side function.
- An admin page is reachable by its address without signing in, and only the link to it is hidden.
- The data request behind an admin page does not check on the server that the person is an admin.
- Row-level security is off on a table, so the public key can read everything in it.
- Uploaded files are in a public storage bucket that anyone with the address can open.
You can't see it yourself
You're signed in, your customers aren't. You are signed in as the owner, so every page works for you. Nothing looks wrong, and a stranger can see what you cannot.
Related: Users can see other users' data in my Lovable app · Data won't save: "new row violates row-level security policy" · My builder says the app is tested, but my customers hit problems
VibeFix is independent. Lovable, Bolt, Replit, Base44, v0, Supabase, Firebase, Stripe and Vercel are trademarks of their owners.
Want it fixed?
Our AI agent finds the cause, fixes it in your code and re-checks your live app. $79 for one bug, paid up front. If we can't complete your re-check, you get your money back.
It starts with a free check that confirms the problem on your live app, no account needed.