What is API key exposure?
API key exposure means a secret key for a paid service, like OpenAI, Stripe or your database, ends up somewhere the public can see it: your website's code, a public GitHub repo, or a screenshot. Anyone who finds it can use the service as you, and you pay the bill.
Also called: Leaked API key, exposed secret
ON THIS PAGE
What it means
An API key is a password that lets your app use another service, like OpenAI for AI features or Stripe for payments. Some keys are meant to be public. Secret keys are not.
A secret key is exposed when it's placed anywhere outside your server: in code that runs in the browser, in a public GitHub repository, or in an old commit you later deleted.
Why it matters for vibe-coded apps
AI tools often put keys wherever the code needs them, which is frequently the front end. Bots scan GitHub and websites for keys around the clock.
- Strangers can run up large bills on your account.
- A database or Stripe secret key can give full access to your data or payments.
- Deleting the key from your code doesn't help if it's still in your git history.
Example
An AI chat feature that calls OpenAI.
// In a React component, shipped to every visitor's browser
const openai = new OpenAI({
apiKey: "sk-proj-8f3k…"
});// In a server function. The key never leaves your server
const openai = new OpenAI({
apiKey: process.env.OPENAI_API_KEY
});Your front end calls your server function, and the server function calls OpenAI.
How to check if your app has this problem
- 1Open your live site, right-click, choose View Page Source, and search for sk-, key and secret.
- 2Search your GitHub repo, and its history, for anything that looks like a key.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Revoke the exposed key in the service's dashboard and create a new one. Do this first.
- 2Store the new key in an environment variable on your server.
- 3Move any code that uses it into a server or edge function.
- 4Run a check again to confirm no keys are visible.
Move every secret API key out of my front-end code. Create a server-side function for each call that needs a secret key, read the key from an environment variable, and update the front end to call that function instead.
Check if your app has this problem
Paste your website and we'll check for API key exposure issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- Environment variablesSettings stored outside your code, used to keep secrets out of it.
- Exposed .env fileYour secrets file can be downloaded from your live website.
- Service role keyA Supabase key that skips every security rule, meant only for your server.
- Row level securityA database setting that decides which rows each user can see or change.
- Rate limitingA cap on how many requests someone can make in a set time.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.