Guide
Exposed API keys in AI-built apps: how to find and fix them
Why secret keys end up in front-end JavaScript, how to check your app, and what to do if a key has leaked.
Why it happens
Anything shipped to the browser can be read by anyone: HTML, JavaScript bundles and source maps. Build tools inline environment variables with public prefixes such as VITE_ or NEXT_PUBLIC_ directly into the bundle.
AI builders sometimes call third-party APIs (OpenAI, Anthropic, Stripe and others) straight from the front-end, which needs the key to be in the browser.
Which keys are fine to expose
Some keys are designed to be public: a Supabase anon/publishable key, a Stripe publishable key (pk_), and Firebase web config. Their safety depends on server-side rules such as Supabase RLS or Firebase Security Rules.
Secret keys must never be public: Stripe secret keys (sk_live_), OpenAI and Anthropic API keys, AWS access keys, GitHub tokens and a Supabase service_role key.
How to fix a leaked key
Revoke or rotate the key in the provider's dashboard first. Removing it from code is not enough, because it may already have been copied.
Move the API call into a server-side function (an Edge Function, serverless function or API route) and store the key as a server-only environment variable.
Redeploy, then re-scan to confirm the key no longer appears in your bundles.
How StackSiren checks
StackSiren downloads your public HTML and same-origin JavaScript bundles, like a browser does, and matches known key formats. Any match is shown masked; we never display or store the full value.