Description

Ensure environment variables configured on static sites do not contain secrets such as API keys with write access, passwords, or private tokens. Values used during a static site build can be written into the generated files that every visitor downloads.

Rationale

Static site frameworks often embed environment variables into the built HTML and JavaScript. Any secret used this way becomes public and can be read by anyone viewing the site's source. Keeping secrets out of static site variables, and calling a backend service instead, prevents them from leaking.

Impact

  • Secrets are not exposed in public site files

  • Sensitive operations must move to a backend service

  • Leaked secrets must be rotated

Default Value

Render does not check static site environment variables for secrets.

Pre-Requisites

  • Admin or Developer role on the static site

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the static site to open it.

  3. Open the Environment page and review each environment variable.

  4. Check the deployed site's files (for example with your browser's developer tools) for any secret values.

  5. If any variable contains a secret, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the static site to open it.

  3. Open the Environment page and remove the secret variable, or replace it with a non-secret public value.

  4. Move any operation that needs the secret into a backend web service or private service.

  5. Rotate the exposed secret with its provider, then redeploy the static site.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the static site to open it.

  3. Open the Environment page and add the variable back if it was needed (only non-secret values).

Reference