Will It Vibe?Secret leaked through getServerSideProps/getStaticProps
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A data-fetching function assigns a non-public process.env value to a props field. Everything returned in props is serialized into the page HTML and the client bundle, so the secret reaches the browser.
Why it matters
Whatever getServerSideProps or getStaticProps returns under props is serialized into the page HTML and hydration payload, which the browser downloads in full. Passing a non-public process.env value through props therefore hands that secret to every visitor, even though the fetch itself ran on the server. This is one of the most common accidental secret leaks in the Pages Router.
How to fix it
Use the secret on the server to produce a safe result (a filtered API response, a signed URL, a boolean) and return only that result in props. Never place a raw credential, connection string, or private token into the props object.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo