Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Check both the code repository and the files the deployed app sends to a browser. A key removed from the latest code may still exist in Git history, while a repository scan will not necessarily catch a credential embedded in a built JavaScript bundle or exposed source map. If a live secret is exposed, revoke or rotate it with its provider; deleting the code alone does not make the credential safe.
What to check first: the deployed app
Anything delivered to a browser can be inspected by users. That includes JavaScript bundles and, when available, source maps that make bundled code easier to read. OWASP identifies API keys and credentials in client-side JavaScript as a risk and recommends checking exposed source maps: OWASP: Client-Side JavaScript Source Map Disclosure.
- Open the deployed app in a browser and use the page source or developer tools to identify the JavaScript files it loads.
- Inspect those files and any accessible source maps for credentials, private keys, internal endpoints, sensitive routes, and configuration that should not be public.
- For a suspicious value, identify its provider and credential type. Check whether it is intended to be public and whether it is restricted to the correct services, origins or referrers, applications, or IP ranges.
A key-looking string is not automatically a secret: some services issue public or publishable keys for browser use. But a key that is intended to be private, or a public key without appropriate restrictions, can still create risk. OWASP’s guidance explains why exposed client-side keys and unrestricted credentials need attention: OWASP’s client-side testing guidance.
Search the source and the full Git history
Search source and configuration files for credential-like values, then run a secret scanner against the repository. Include the full Git history, not just the current working tree: an old commit or branch may retain a value even after the corresponding line has been removed. GitHub’s documentation recommends identifying the credential type, provider, repository, file and line, and secret owner when investigating a finding: GitHub: Remediating a leaked secret.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Search current files and configuration, including build and deployment-related files.
- Run a repository secret scan, configured for the credential types and custom patterns relevant to the project.
- Scan historical commits and branches as well as the latest version.
- Validate a finding with the credential issuer. Scanners can miss unfamiliar formats and can flag harmless strings.
- Keep the credential itself out of screenshots, public bug reports, and AI prompts.
A repository scanner and a check of deployed browser assets cover different places. Use both; a clean scan of source does not establish that the browser receives no sensitive value, and inspecting the deployed bundle does not establish that the repository history is clean. GitHub notes that secret scanning and push protection do not cover every secret type by default, so these controls reduce risk rather than guarantee that no credential can escape: GitHub: About secret scanning.
What to do if a live credential is exposed
- Revoke or rotate it with the provider. Treat an active exposed credential as compromised. If revoking it immediately would interrupt a service, GitHub advises that in some cases you can create a replacement, move the application to it, and then revoke the exposed credential.
- Update the application’s private configuration. Put the replacement where the server-side component or deployment can use it without sending it to the browser.
- Review provider activity. Check available usage or access logs for activity you do not recognize.
- Consider repository cleanup after rotation. Removing a value from the current files or rewriting history does not invalidate it. History cleanup may be appropriate, but rotation comes first; also consider notifying people who cloned the repository.
See GitHub’s response guidance for a leaked credential: Remediating a leaked secret. OWASP likewise emphasizes rotating an exposed secret before treating repository cleanup as the remedy: OWASP client-side testing guidance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Prevent the next generated version from exposing secrets
AI coding tools should not have access to live credentials in the first place. OWASP’s Secure Coding with AI guidance recommends excluding files such as .env, .env.*, private keys, and credential files from assistant context, and storing secrets in environment variables, vaults, or encrypted stores rather than project files the assistant can read: OWASP Top 10 for Large Language Model Applications. A .gitignore rule only affects Git; it does not prevent an AI tool from reading a file directly.
- Keep private credentials in a server-side secret store or deployment environment, not frontend source or browser-delivered configuration.
- Use editor or pre-commit detection for quick feedback, and add server-side CI or push checks so a local bypass is not the only barrier.
- Schedule scans of full repository history and monitor public repositories where relevant.
- Review AI-generated changes to build scripts, CI workflows, container files, and deployment configuration, not only application code. OWASP’s secure-coding guidance for AI also calls for reviewing generated code and security-sensitive changes: OWASP guidance for AI-assisted coding.
When evaluating a scanning control, check when it runs, which standard and custom patterns it covers, whether it can validate a credential, how it handles false positives and bypasses, whether it checks deployed bundles as well as repository files, and what hosting or plan requirements apply. Push protection can stop some commits containing detected secrets, but coverage varies by secret type and is not a complete guarantee: GitHub secret scanning coverage.
Quick Recap
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
