Ship it path Data and sign-in

Keep secret keys out of the page

Find a secret key in a page, remove it, and say where it belongs instead.

Example brief

A notes app plans to call an AI service and has the service key typed into the page. Anyone can open View source and copy it.

An example. Use your own idea next.

Steps

Use the starting project: open the code on the Code tab of your builder and find the long key. Who can see it?
Ask the AI to remove the key from the page and explain that it must live on a server.
Generate, then run the checks: no key-shaped text may remain, and the notes must still work.

What you will learn

Secrets: Keys and passwords that grant access. They belong on a server or in a secrets manager, never in a page or a public code repository.
Rotating a key: Replacing a key with a new one and cancelling the old one. Do this whenever a key may have been seen by someone else.

A sample prompt

The API key is typed into the page, so anyone can copy it. Remove the key from the page and say it must live on a server instead. Keep the note form and list the same.

Write yours first, then compare.

To complete it

Pass all 9 checks and 1 behaviour tests on one version, then accept. You start from a working project and change it.