Security audit
Security checks for vulnerabilities and agentic risk
This is a documentation-only migration skill that gives expected Mapbox setup guidance, with ordinary token and Mapbox API considerations users should understand.
Before installing or using this skill, be comfortable with moving a project onto Mapbox services: you will need a Mapbox account, a public client token, possible package changes, and Mapbox API/CDN calls that can reveal location queries to Mapbox and may count toward usage or billing.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Sign up at mapbox.com
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Sign up at mapbox.com
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Sign up at mapbox.com
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
✅ Map initializes without errors
✅ Tiles load correctly (Mapbox tiles, not OSM)
✅ Access token configured
✅ Markers/popups display properly
✅ Events fire as expected
✅ Custom layers render correctly
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Only allow your domains
// ✅ Never commit tokens
// Add .env to .gitignore
// ✅ Use public tokens (pk.*) for client-side
// Never expose secret tokens (sk.*)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Only allow your domains
// ✅ Never commit tokens
// Add .env to .gitignore
// ✅ Use public tokens (pk.*) for client-side
// Never expose secret tokens (sk.*)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Only allow your domains
// ✅ Never commit tokens
// Add .env to .gitignore
// ✅ Use public tokens (pk.*) for client-side
// Never expose secret tokens (sk.*)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
// Only allow your domains
// ✅ Never commit tokens
// Add .env to .gitignore
// ✅ Use public tokens (pk.*) for client-side
// Never expose secret tokens (sk.*)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
VITE_MAPBOX_TOKEN=pk.your_token
// Add .env to .gitignore echo ".env" >> .gitignore
### Issue 3: Wrong Style URL Format
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
{
"id": 2,
"prompt": "I migrated my app from MapLibre to Mapbox GL JS by swapping the package and changing the import. Now I get the error: 'A valid Mapbox access token is required to use Mapbox GL JS. Please set mapboxgl.accessToken before creating a map.' Where does the token go?",
"expectations": [
"Token must be set as mapboxgl.accessToken = 'pk.xxx' BEFORE calling new mapboxgl.Map()",
"Shows the correct pattern: set accessToken at the module level, then create the map",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
{
"id": 2,
"prompt": "I migrated my app from MapLibre to Mapbox GL JS by swapping the package and changing the import. Now I get the error: 'A valid Mapbox access token is required to use Mapbox GL JS. Please set mapboxgl.accessToken before creating a map.' Where does the token go?",
"expectations": [
"Token must be set as mapboxgl.accessToken = 'pk.xxx' BEFORE calling new mapboxgl.Map()",
"Shows the correct pattern: set accessToken at the module level, then create the map",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
{
"id": 2,
"prompt": "I migrated my app from MapLibre to Mapbox GL JS by swapping the package and changing the import. Now I get the error: 'A valid Mapbox access token is required to use Mapbox GL JS. Please set mapboxgl.accessToken before creating a map.' Where does the token go?",
"expectations": [
"Token must be set as mapboxgl.accessToken = 'pk.xxx' BEFORE calling new mapboxgl.Map()",
"Shows the correct pattern: set accessToken at the module level, then create the map",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
{
"id": 2,
"prompt": "I migrated my app from MapLibre to Mapbox GL JS by swapping the package and changing the import. Now I get the error: 'A valid Mapbox access token is required to use Mapbox GL JS. Please set mapboxgl.accessToken before creating a map.' Where does the token go?",
"expectations": [
"Token must be set as mapboxgl.accessToken = 'pk.xxx' BEFORE calling new mapboxgl.Map()",
"Shows the correct pattern: set accessToken at the module level, then create the map",
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
},
{
"id": 2,
"prompt": "I migrated my app from MapLibre to Mapbox GL JS by swapping the package and changing the import. Now I get the error: 'A valid Mapbox access token is required to use Mapbox GL JS. Please set mapboxgl.accessToken before creating a map.' Where does the token go?",
"expectations": [
"Token must be set as mapboxgl.accessToken = 'pk.xxx' BEFORE calling new mapboxgl.Map()",
"Shows the correct pattern: set accessToken at the module level, then create the map",
This markdown file includes fetch examples to Mapbox Geocoding, Directions, and Isochrone APIs, which transmit address and coordinate data to an external service. The surrounding documentation presents these calls as straightforward usage but does not warn that user-entered locations or map context may be sent off-device to Mapbox.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// Geocoding API - Convert addresses to coordinates
const response = await fetch(
`https://api.mapbox.com/search/geocode/v6/forward?q=San+Francisco&access_token=${mapboxgl.accessToken}`
);
// Directions API - Get turn-by-turn directions
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// Geocoding API - Convert addresses to coordinates
const response = await fetch(
`https://api.mapbox.com/search/geocode/v6/forward?q=San+Francisco&access_token=${mapboxgl.accessToken}`
);
// Directions API - Get turn-by-turn directions
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// Geocoding API - Convert addresses to coordinates
const response = await fetch(
`https://api.mapbox.com/search/geocode/v6/forward?q=San+Francisco&access_token=${mapboxgl.accessToken}`
);
// Directions API - Get turn-by-turn directions
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// Geocoding API - Convert addresses to coordinates
const response = await fetch(
`https://api.mapbox.com/search/geocode/v6/forward?q=San+Francisco&access_token=${mapboxgl.accessToken}`
);
// Directions API - Get turn-by-turn directions
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// Geocoding API - Convert addresses to coordinates
const response = await fetch(
`https://api.mapbox.com/search/geocode/v6/forward?q=San+Francisco&access_token=${mapboxgl.accessToken}`
);
// Directions API - Get turn-by-turn directions
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// Geocoding API - Convert addresses to coordinates
const response = await fetch(
`https://api.mapbox.com/search/geocode/v6/forward?q=San+Francisco&access_token=${mapboxgl.accessToken}`
);
// Directions API - Get turn-by-turn directions
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
// Geocoding API - Convert addresses to coordinates
const response = await fetch(
`https://api.mapbox.com/search/geocode/v6/forward?q=San+Francisco&access_token=${mapboxgl.accessToken}`
);
// Directions API - Get turn-by-turn directions
Detected: suspicious.exposed_secret_literal