From the checkup catalog
A secret key in the public JavaScript
Why a key in the bundle counts as public, how long it has likely been exposed, and how to rotate it.
Anything in a script the browser downloads is public. Minification does not hide it. ShipCheck stores a short fingerprint, not the full key, and shows the provider so you know where to rotate.
The leak timer uses the earlier of two clocks: the Last-Modified header on the script, and the first checkup that saw that fingerprint. Purchased credits and the monthly allowance are unrelated to this clock.
Rotate the key in the provider’s dashboard, remove it from client code and from any NEXT_PUBLIC or VITE variable, rebuild, and confirm the new bundle no longer contains the prefix.