Leaked API keys in vibe-coded apps
If your repo is public and a key was ever committed, assume it's compromised. Bots scan public GitHub repos for secrets constantly.
How keys leak
- The AI puts the key directly in
config.js"for now". .envisn't in.gitignore.- A key is deleted in the latest commit but still sits in git history.
- Frontend code ships a secret key to every browser.
What to do right now
- Rotate the key in the provider's dashboard. Deleting it from code is not enough.
- Move it to an environment variable.
- Add
.envto.gitignore. - Scan history with an open-source tool like gitleaks.
Fix prompt you can paste
Find every hardcoded API key or secret in this repo. Move each one to an environment variable, add .env to .gitignore, create .env.example with placeholders, and list which keys I must rotate.
Want a second pair of eyes?
We review your whole repo and write a fix prompt for every finding. $19, report within an hour.
Check my repoLeakcade is an automated check. It can miss vulnerabilities and is not a substitute for a professional security audit or pentest. Provided as is. You stay responsible for your code. Where the law allows, our liability is limited to what you paid ($19). Terms