Check · Art. 32 GDPR
Admin key exposed in frontend code
What it means
A service-role or admin API key is shipped inside the JavaScript your visitors download. Anyone can extract it and act as your backend.
Why it matters
With an admin key an attacker bypasses every access rule — full read and write on your data. Under Art. 32 GDPR that's a failure of basic technical measures, and you are the accountable operator.
How to fix it
Revoke the key, issue a new one, and move every admin operation to a server-side function. The frontend should only ever hold the public/anon key.
Does your app have this problem? The free passive check tests this and 4 more areas — no login, nothing touched.
Check your app free