Fix guide · high · datadog_app_key_labelled
Datadog Application key in client code
What this rule means
A DD_APP_KEY / DATADOG_APP_KEY / DD-APPLICATION-KEY-labelled 40-char hex string was found in your client.
Why it matters
Application keys (different from API keys) grant access to the Datadog API on behalf of the user who created them. Paired with an API key, attackers get read access to your dashboards, monitors, logs, traces — and write access to modify them.
How to fix it
- Revoke at app.datadoghq.com/organization-settings/application-keys.
- Move all Datadog API calls server-side. Application keys should never appear in browser-bundled code.
- Audit Datadog usage logs for unfamiliar API calls during the exposure window.
Did vibecheck flag this on your app?
If you reached this page from a vibecheck inspection report, the redacted match in your scan output is the exact string we found in your bundle. After applying the fix above, run the inspection again — the finding should clear.
Run another inspection