Possible secret credentials found in public JavaScript files

This check scans the site's public JavaScript bundles, the code files a browser downloads to run the site, for patterns that look like API keys, tokens, or other secret credentials. On this site, potential secret credentials were detected inside publicly accessible JavaScript files. Anything shipped inside a public JavaScript bundle is downloaded by, and readable by, every single visitor to the site, so a secret credential there isn't hidden, it's effectively published to the entire internet. Depending on what the credential grants access to, this can range from a minor exposure to a direct path into backend systems, payment processing, or customer data. Your developer should treat any leaked credential as compromised and rotate it immediately at the service it belongs to, regardless of how the investigation into the cause turns out. Then move whatever the secret was protecting, such as a private API call, to a server-side route or backend proxy, so the actual secret never ships to the browser in the first place.