Netlify secret scanning failed the build

What it means in plain English

Netlify's smart detection scans the repository and the build output for secrets, with no extra setup. Netlify says that when it finds one, the build fails so the secret is not published, and the deploy log names the location.

Likely causes

• An API key was committed, or a public env prefix baked it into the JavaScript.
• A sample key in a fixture looks like a real secret.
• The AI pasted a live sk_ or service key into a component "just for now."

How to fix it, step by step

1. Open Site dashboard, then Deploys, and read the log line that names the file. Netlify says that is where the location is shown.
2. Delete the secret from that file and from git history you are about to deploy. Rotate the key at the vendor, because it has already been in the project. Redeploy. Netlify says a removed value should not be detected again.
3. If the string is not a secret, Netlify's documented safelist is an environment variable named SECRETS_SCAN_SMART_DETECTION_OMIT_VALUES. Add it under Project configuration, then Environment variables, with the false positives separated by commas. Then use Deploys, Trigger deploy, Deploy project.
4. Leave scanning on. Netlify says setting SECRETS_SCAN_SMART_DETECTION_ENABLED to false only turns off smart detection, and setting SECRETS_SCAN_ENABLED to false turns off scanning for secrets you marked as well.

How to check it worked

• The next deploy finishes.
• The published JavaScript does not contain the key the log named.

Sources

• https://docs.netlify.com/manage/security/secret-scanning/ (opens in a new tab)