Leaked API Keys: Find and Rotate Them in 15 Minutes
Quick answer
Leaked API keys in vibe-coded apps usually end up in client-side code through VITE_ env vars, hardcoded strings the AI generated, or committed .env files. Find them with a repo-wide secret scan plus your built client bundle, then rotate every exposed key at the provider and move the value server-side — deleting the file is not enough if it was ever committed.
How keys leak in AI-built apps
Vibe-coding tools optimize for a working demo, and the fastest path to a working demo is putting the key where the code runs: the browser. Three patterns cover most leaks we see:
- Secrets in VITE_/NEXT_PUBLIC_ env vars — anything with those prefixes ships to the client bundle.
- Hardcoded keys the model wrote inline while wiring a provider (Stripe, OpenAI, Resend, Supabase service_role).
- Committed .env files or .env committed before .gitignore existed — history keeps it forever.
Find exposure in 10 minutes
Search first, tools second — these catch the obvious stuff:
- grep -riE '(sk-[a-zA-Z0-9]{20,}|sbp_[a-zA-Z0-9]{20,}|AIza[a-zA-Z0-9_-]{30,})' --exclude-dir=node_modules .
- Check git history, not just HEAD: git log -p -- .env | head.
- Build the app and grep the dist/ bundle — what ships is what counts.
- Paste your repo URL into GitHub's secret scanning alerts (free for public repos).
Rotate the right way
Rotation is the part teams skip, and it's the only part that actually closes the hole. For each leaked key:
- Revoke/re-issue at the provider dashboard — do not just delete it from the code.
- Move the value to a server-only env var (no public prefix) and read it from a server function or edge function.
- Check provider logs for foreign usage between leak date and rotation — assume it was used.
- If it was committed, treat git history as compromised; rotation (not history rewrite) is the fix.
Prevent the next one
Add a pre-commit secret scanner (gitleaks is one command), keep every provider call server-side, and re-scan on every deploy — drift happens fast in AI-built apps because features change daily. A scheduled scan that runs without you remembering is worth ten manual greps.
StackShield's GitHub scan sweeps your whole repo and history for live key patterns (OpenAI, Anthropic, Stripe, Supabase, and more), tells you which are still valid, and drafts the server-side fix for your approval. The free plan includes it — run a scan now.
Run a free scan