# Ensure static site build variables contain no secrets

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876664927235-ensure-static-site-build-variables-contain-no-secrets
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure environment variables configured on static sites do not contain secrets such as API keys with write access, passwords, or private tokens. Values used during a static site build can be written into the generated files that every visitor downloads.

**Rationale**

Static site frameworks often embed environment variables into the built HTML and JavaScript. Any secret used this way becomes public and can be read by anyone viewing the site's source. Keeping secrets out of static site variables, and calling a backend service instead, prevents them from leaking.

**Impact**

-   Secrets are not exposed in public site files
    
-   Sensitive operations must move to a backend service
    
-   Leaked secrets must be rotated
    

**Default Value**

Render does not check static site environment variables for secrets.

**Pre-Requisites**

-   Admin or Developer role on the static site
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the static site to open it.
    
3.  Open the Environment page and review each environment variable.
    
4.  Check the deployed site's files (for example with your browser's developer tools) for any secret values.
    
5.  If any variable contains a secret, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the static site to open it.
    
3.  Open the Environment page and remove the secret variable, or replace it with a non-secret public value.
    
4.  Move any operation that needs the secret into a backend web service or private service.
    
5.  Rotate the exposed secret with its provider, then redeploy the static site.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  From your workspace home (or project), click the static site to open it.
    
3.  Open the Environment page and add the variable back if it was needed (only non-secret values).
    

**Reference**

-   [https://render.com/docs/static-sites](https://render.com/docs/static-sites)
    
-   [https://render.com/docs/configure-environment-variables](https://render.com/docs/configure-environment-variables)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.