Cyble finds live secrets in browser code of 35 AI-built sites
Original title: The Keys Are in the Browser: Secret Exposure Across AI-Built Websites
Of 22,306 AI-built sites among 1.3 million new domains, 35 exposed server-only credentials including OpenAI, Stripe, and database tokens.
Cyble Research and Intelligence Labs scanned more than 1.3 million newly registered domains and classified 22,306 as built by AI app-builders. On 35 of those sites, private secrets sat in public front-end code: live OpenAI API keys, a Slack webhook reused across 13 domains, a Stripe secret key, Supabase service-role JWTs, and AWS access keys. Thousands of other strings were browser-safe keys and were excluded. The Slack fleet ran on Bubble; the Stripe cluster used a Next.js build.
Unconfirmed: The AWS finding is truncated, and the Stripe table lists six sites while the narrative describes one key on four domains.
- Five sites held 16 OpenAI keys; one writing site shipped 12 keys.
- One Slack incoming webhook was embedded on 13 near-identical Bubble domains.
- Four sites exposed Supabase service-role JWTs that bypass row-level security.
- Cyble also counted five AWS access keys; that row is cut off in the text.
- 3,824 sites only had browser-safe values such as reCAPTCHA and publishable keys.
Impact: Live billing, payment, chat, and database credentials in page source
- 1.Revoke any OpenAI, Stripe, Slack, Supabase service-role, or AWS secrets found in client bundles
- Organizations
- Cyble
From the original article
7 min read at cyble.com
Cyble scanned 1. 3M+ newly registered domains and found AI-built sites leaking live secrets to the browser: OpenAI keys, Stripe keys, and database tokens. Spinning up a website no longer takes a developer.
By rohansinhacyblecom · cyble.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.