Exposed Secrets Fix NextJS Cursor: A Practical Guide
OverMCP Team
Quick answer
To fix exposed secrets in a Next.js app built with Cursor, immediately rotate the leaked keys (e.g., API keys, tokens), remove them from your codebase (especially client-side code), and move them to secure environment variables on your hosting platform (e.g., Vercel). Then run a secret leak scanner to catch any remaining exposures and set up continuous monitoring to prevent future leaks.
What to check first
Before you panic, verify the extent of the leak:
Step-by-step fix
1. Rotate the exposed secrets immediately
If you've confirmed a leak, don't just delete the key – rotate it. For example:
2. Remove secrets from your codebase
Search your project for any hardcoded secrets. Common patterns:
// ❌ BAD: Hardcoded in client component (Cursor might generate this)
const openAiKey = "sk-1234567890abcdef";
// ✅ GOOD: Use environment variable
const openAiKey = process.env.OPENAI_API_KEY;Also check for secrets in:
getServerSideProps or API routes that send secrets to the clientnext.config.js if you're exposing env vars via publicRuntimeConfigproductionBrowserSourceMaps: false)3. Move secrets to environment variables
In Next.js, use .env.local for local development and set variables in your hosting provider:
# .env.local (never commit this!)
OPENAI_API_KEY=sk-...
STRIPE_SECRET_KEY=sk_live_...On Vercel: Go to Project Settings > Environment Variables, add the keys. Mark sensitive keys as "Secret" so they don't appear in logs.
4. Add secrets to `.gitignore`
Ensure .env.local and any other sensitive files are never committed:
# .gitignore
.env.local
.env.*.local
*.pem5. Scan your entire Git history
If a secret was committed in the past, it's still accessible. Use a tool like git filter-branch or BFG Repo-Cleaner to purge it, but first rotate the key – history rewriting is risky.
6. Set up continuous monitoring
Prevent future leaks by integrating a continuous security monitoring tool that scans every commit and deployment for secrets. OverMCP can automatically check your Vercel deployments for exposed keys.
Common mistakes
NEXT_PUBLIC_ prefix for secrets – these get bundled into client JS and are visible to anyone..env that you forget to ignore.productionBrowserSourceMaps: true, your API keys can be extracted from the browser.How OverMCP helps
OverMCP is a free AI app security scanner built for vibe-coded apps. It automatically scans your Next.js project for exposed secrets in code, Git history, and client-side bundles. Connect your Vercel project to get continuous security monitoring and catch leaks before they become breaches.
FAQ
How do I check if my Next.js app has leaked secrets?
Use a secret leak scanner to scan your public repository, client-side JavaScript, and environment variables. Also check your hosting platform's logs for any keys accidentally printed.
Can I use `NEXT_PUBLIC_` for API keys?
No. Any variable prefixed with NEXT_PUBLIC_ is exposed to the browser. Only use it for non-sensitive values like public URLs. Always keep secrets in server-side environment variables.
What if the leaked key is in a public GitHub repo?
Immediately rotate the key. Then remove it from the repo's Git history using git filter-branch or BFG. Finally, add a .gitignore rule and consider using a secrets scanner in your CI/CD pipeline.