`src/content/posts/2026-06-16-the-password-i-shipped-to-the-browser.md`

56 lines

---
title: "The Password I Shipped to the Browser"
description: "A dashboard was printing its own auth password into client-side code. Here's how I found it, why it happened, and the canary I added so a dead token never goes unnoticed again."
date: 2026-06-16
tags: ["security", "secrets", "monitoring", "postmortem", "founder-log"]
---

Two security fixes today, and I'm going to be honest about the first one because the honesty is the point: a dashboard was shipping its own auth password into the browser. My mistake. Found it, fixed it, and then built the thing that would have caught it.

## What Happened

The dashboard was protected by basic auth. Somewhere in its startup/error handling, the password ended up embedded in the client-side code — the stuff that gets sent to every visitor's browser. A secret-scanning tool flagged it. Anything shipped to the browser is public; there is no "but you'd have to look" — view-source is one keystroke.

How does a password end up in browser code? The usual way: a helpful error message. Some boot-error path was constructed with the config values inline "to make debugging easier," and the config included the credential. It was convenient exactly until it was a leak.

## The Fix

Two parts, both non-negotiable:

1. **Remove the credential from anything that reaches the client**, and **rotate it.** A leaked secret is a dead secret — you don't un-leak it, you replace it. So the old one is gone, not just hidden.
2. **The credential lives server-side only**, injected at runtime, never baked into shipped code.

## The Better Fix: A Canary

The more valuable outcome today was the second one. A different system had a token that could silently expire — and when it did, a whole panel of the product just quietly went dark. No error, no alert. It looked "connected" while doing nothing.

So I built a token-health canary: it periodically checks that the token is actually alive, warns before it's about to expire, and stamps a heartbeat every run. If the token dies — or if the canary itself stops running — I get told, instead of discovering it weeks later because something looked off.

## The Lesson

Two lessons, really:

- **Convenience is the most common cause of leaks.** Nobody sets out to ship a password. They add a debug string, or an error message with "helpful" context, and the secret rides along. Assume anything that reaches the browser is public, and never construct client-facing strings from config that might contain secrets.
- **Silent failure is worse than loud failure.** A token that dies quietly is more dangerous than one that dies with an alarm, because you build on the assumption it's working. Every critical credential should have something watching that it's alive — and something watching the watcher.

## Why This Matters for Business Owners

The scary security problems usually aren't dramatic breaches — they're small, quiet lapses. A secret that leaked through a convenience. A connection that died without telling anyone. Two cheap habits prevent most of the damage: scan for secrets automatically so a leak gets caught the day it happens, and put a heartbeat on anything whose silent death would hurt. Both are inexpensive. Both save you from the class of problem you only discover long after it started.

## Let's Connect

I build AI-powered automation for real businesses — not demos, not prototypes, production systems that run 24/7.

If you're a **founder, entrepreneur, or small business owner** looking to automate operations with AI, let's talk:

- [**@agentabrams on YouTube**](https://youtube.com/@AgentAbrams) — walkthroughs and demos
- [**@agentabrams on X**](https://x.com/agentabrams) — DMs open
- [**@agentabrams on Bluesky**](https://bsky.app/profile/agentabrams.bsky.social) — follow along
- [**goodquestion.ai**](https://goodquestion.ai) — you're here

**Advisory & Board Opportunities:** I'm actively looking to join boards where AI automation can drive real business value. If your company is exploring AI-driven operations, data pipelines, or autonomous agent systems — I'd love to contribute as a board member or advisor. Reach out on any platform above.

---

*Built with [Claude Code](https://claude.ai). Shipped in production. Every day. This is what one founder + AI looks like.*