What does 'exposed secret' mean?

Dotvault has spotted a value that looks like an API key or token, matching known patterns from Stripe, GitHub, AWS, and similar, in a file that’s tracked by git and not in .gitignore. The fix is almost always one of two things: add the file to .gitignore, or rotate the secret. Probably both, if it’s already been pushed.

Gitignoring the file clears this one, because the file is then not exposed to git at all. That is the difference between it and the other secret warning: a client-exposed secret is one your framework compiles into the browser bundle, and no amount of gitignoring changes what ships to the page. Where a value is both, you get the client-exposed badge rather than two, because that is the bigger problem of the two.