How to Keep Secrets Out of Published HTML

Display is our product. We checked the Display facts against the Security page on 14 October 2026.

What Display does with your file

Artifacts open at *.dsp.so. Scripts, styles and embedded resources get to the browser of the reader without changes. Display controls who can open an artifact. It does not change the file. A reader who can open the artifact can read all of it, including text that is in the page source only. Read the section "Scripts in artifacts run with normal browser capabilities" on the Security page.

Where secrets come from

• Environment output. The agent ran env or printed a config file, then put the result in a summary.
• Logs and stack traces. They can contain tokens, URLs with keys and email addresses.
• Customer data. A report copies rows from a database.
• Fixed values in generated code. A dashboard calls an API with a key in the script.
• Exported sessions. A transcript holds every command and its output. Read How to export and share a coding agent session.

Check the file before you publish

Search the file for common patterns:

grep -n -i -E "api[_-]?key|secret|token|password|bearer |sk-|AKIA" ./report.html

This list of patterns is not complete. Read the page source for URLs that contain ?key= or ?token=. You can also ask the agent: "List every credential, token, email address and customer name in report.html. Do not publish."

Publish in the safest order

1. Tell the agent: "Publish report.html to Display as Private."
2. Open the URL and read the page source.
3. Tell the agent: "Update the page at the same link and set it to Company."
4. Use Public only for a page that is for anyone.

An update keeps the same URL. On paid plans, older versions stay in the history, so a secret that you remove in version 2 is still in version 1. Rotate every secret that was in a version. Remove the artifact if the content must be gone.

What to do if you published a secret

1. Rotate the secret at its provider.
2. Remove the artifact, or change it to Private.
3. Check the audit log if your plan has one (Pro: 90 days, Enterprise: 365 days).
4. Report a security incident to privacy@display.dev.

When another approach is better

If a page must call a service with a key, make that call on a server and publish only the result. Display does not run server-side code.