How to check if your AI-built app leaks API keys

AI coding tools often paste keys straight into code to make something work. Here is how to find them and clean up properly.

1. Know which keys are actually secret

Some keys are designed to be public, such as a Supabase anon key or a Stripe publishable key (pk_). Others must never leave your server: Stripe secret keys (sk_), the Supabase service_role key, OpenAI or Anthropic API keys, database URLs with passwords, and webhook signing secrets.

2. Check what ships to the browser

In Next.js, any environment variable starting with NEXT_PUBLIC_ is bundled into frontend JavaScript. In Vite (common in Lovable and Bolt projects) the same applies to VITE_. If a secret key has one of these prefixes, assume it is public. You can also open your live site, view the page source or the Network tab, and search for sk_ or your key's first few characters.

3. Scan the repo, including history

Deleting a key from the latest commit doesn't remove it from git history. A scanner such as gitleaks checks the whole history: gitleaks git -v from your repo folder (older versions use gitleaks detect). Also check that .env files are listed in .gitignore and were never committed.

4. If you find a leaked secret

• Rotate it first. Create a new key in the provider's dashboard and revoke the old one. Once a key has been in a public repo, treat it as compromised.
• Move the new key into server-side environment variables (for example in your hosting provider's settings), without a public prefix.
• Only call the provider from server code (API routes, server actions, edge functions), never from the browser.
• Check the provider's usage and billing pages for activity you don't recognize.
• Rewriting git history is optional after rotating; the old key is useless once revoked.

5. Prevent it next time

Tell your AI tool explicitly: "never hard-code secrets; read them from server-side environment variables." Consider running gitleaks as a pre-commit hook or in CI.

Automated checks and general guidance, not a substitute for a professional security audit.

All guides · Home · Terms · Privacy