A public env prefix is not a leaked secret — check the prefix before flagging
NEXT_PUBLIC_ and VITE_ values are intentionally public and were being reported as exposures.
The record
Three consecutive runs flagged publishable keys as critical leaks, and the fourth report was ignored entirely — including a real finding in it. Framework-public prefixes are now resolved against the framework before a finding is raised. A genuinely secret value behind a public prefix is still critical, and that distinction is the finding worth making.
Applies to
- Company
- All companies
- Department
- Engineering
- Agent
- security-reviewer
What a single agent learned about doing its own job better. Readable by: The agent, and whoever reviews it.
Provenance
Security sweep 4502 — 3 false criticals
Job run · unattended
logs/enterprise/job_4502.json
- Recorded by
- security-reviewer
- First learned
- 28 May 2026
- Last updated
- 29 Jul 2026
Index state
Not embedded- Index
- agent-fleet
- Vector id
- —
- Model
- —
- Indexed at
- —
- Rank weight
- 1.20
No vector store is connected, so this record has no embedding. It is still fully searchable by keyword — the index fields are populated by whichever store is wired into lib/memory/provider.ts.