Signals Source and build
Secrets in the client bundle
- Category
- Source and build
- Direction
- Pushes the score up
- Weight
- +30
- Floor
- 62
What it is
What is visible in the shipped code. One signal is not a verdict. The score is the whole weighted set, not any single line of it.
How it is weighted
At 30 points this is one of the heaviest tells in the set. It is close to conclusive on its own.
It also carries a floor of 62. When this fires the score is not allowed to fall below that number, however much craft the rest of the page shows — some tells settle the question rather than contribute to it.
What to do about it
Rotate every exposed key today, then move the calls behind your own server route. A key in the shipped JavaScript is public the moment it is deployed.
Where it fires
None of our worked examples trip this one, which is itself informative — it means the pattern is rarer than the tells that fire constantly, so when it does show up it is worth paying attention to.