Fix guide · critical · twilio_auth_token
Twilio Auth Token in client code
What this rule means
A TWILIO_AUTH_TOKEN-labelled 32-char hex string was found in your deployed JavaScript.
Why it matters
Paired with the Account SID (often also leaked nearby — see twilio_account_sid), the auth token grants full SMS, voice, WhatsApp, and Verify abuse. Costs ramp fast: a single attacker can spend hundreds of dollars sending SMS in minutes.
How to fix it
- Rotate the auth token at twilio.com/console → Account → API keys → Auth Token → Reset.
- Switch to API keys (twilio.com/docs/iam/api-keys) scoped to specific resources instead of the master auth token.
- Move all Twilio calls server-side: client → your API → Twilio. The auth token must never appear in browser-bundled code.
- Set spending limits in your Twilio account as a safety net.
Did vibecheck flag this on your app?
If you reached this page from a vibecheck inspection report, the redacted match in your scan output is the exact string we found in your bundle. After applying the fix above, run the inspection again — the finding should clear.
Run another inspection