Leaked API keys in vibe-coded apps

Updated Oct 22, 20263 min read

If your repo is public and a key was ever committed, treat it as a leaked API key, even if you deleted it later. Bots scan public GitHub repos for secrets all the time. GitHub counted more than 39 million leaked secrets across the platform in 2024. Here's how keys leak in AI-built apps and what to do, in order.

How a leaked API key ends up public

• The AI puts the key directly in config.js "for now".
• .env isn't in .gitignore, so the first git add . commits it.
• A key is deleted in the latest commit but still sits in git history, where anyone can read it.
• Frontend code ships a secret key to every browser, often through a VITE_ or NEXT_PUBLIC_ variable.

Hardcoded keys are one of the AI-generated code security risks we see most.

What to do when an API key leaked

1. Rotate the key

   Create a new key in the provider's dashboard and revoke the old one. Do this first. The old key stays usable until you revoke it.

2. Check what it was used for

   Look at the provider's usage, logs and billing for calls you didn't make. For cloud and payment keys, check for new resources or payouts.

3. Move it to an environment variable

   Read the key with process.env (or your framework's server-only env) and keep the value out of the code.

4. Ignore .env

   Add .env to .gitignore and commit a .env.example with placeholder values.

5. Scan the whole history

   Run gitleaks git (older versions: gitleaks detect) on the repo to find every secret in every commit, not just the latest.

6. Rewrite history only if you need to

   GitHub's docs explain how to remove secrets from git history with git filter-repo. It's optional once the key is rotated, and it doesn't remove copies people already cloned.

Before and after

// src/config.js
export const openai = new OpenAI({
  apiKey: "sk-proj-...",
})

// src/config.js (server only)
export const openai = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY,
})

# .gitignore
.env

Fix prompt you can paste

Find every hardcoded API key or secret in this repo. Move each one to an
environment variable, add .env to .gitignore, create .env.example with
placeholders, and list which keys I must rotate.

How Leakcade checks this

We run gitleaks on your files and on recent git history, so a key that was "deleted" later still shows up. Keys appear only partly masked in your report. We also flag secret-looking variables with a public prefix, which ship to the browser even when they never reach git.

Further reading

1. GitHub blog: 39M secret leaks in 2024
2. GitHub docs: Remediating a leaked secret
3. GitHub docs: Removing sensitive data from a repository
4. gitleaks on GitHub

FAQ