Is deleting the API key from my code enough after a leak?

No. Once a key has been public, assume it was copied. Bots scan websites and GitHub for keys constantly. You must revoke or rotate the key with the provider so the old one stops working, then use a new key that only lives on the server.

Why is my key in the browser even though I put it in a .env file?

Environment variables whose names start with VITE_, NEXT_PUBLIC_, REACT_APP_ or EXPO_PUBLIC_ are deliberately copied into your front-end JavaScript, where anyone can read them. Secret keys must use names without those prefixes and be used only in server-side code such as an API route or a Supabase Edge Function.

Which API keys are safe to have in front-end code?

Keys designed to be public: Stripe publishable keys (pk_), Supabase publishable (sb_publishable_) or legacy anon keys, and Firebase web config keys when your security rules are set correctly. Secret keys such as Stripe sk_, OpenAI sk-, Anthropic sk-ant-, Supabase sb_secret_ or service_role, and AWS access keys must never be in front-end code.

Vibeproof / Guides · Privacy

I leaked my API key in my app. What do I do now?

Your OpenAI, Anthropic, Stripe, Supabase or AWS key ended up in your website's code or a public GitHub repo. Don't panic, but do act now. Here's the 10-minute checklist.

Updated October 15, 2026 · 6 min read

Do these 3 things right now

Revoke or rotate the key with the provider (table below). Deleting it from your code is not enough.
Check your bill and usage for anything you didn't do.
Move the new key to the server so it never reaches the browser again.

Step 1: Kill the old key (do this first)

Once a key has been visible on a website or GitHub, assume someone copied it. Automated bots scan for keys constantly. The only fix is making the old key stop working.

Provider	Key looks like	Where to revoke it
OpenAI	`sk-proj-...`	OpenAI platform → API keys → delete the key, then create a new one.
Anthropic	`sk-ant-...`	Anthropic Console → API Keys → disable or delete it, then create a new one.
Stripe	`sk_live_...` / `rk_live_...`	Stripe Dashboard → Developers → API keys → Roll key.
Supabase (new keys)	`sb_secret_...`	Settings → API Keys: create a new secret key, switch your server code to it, then delete the leaked one.
Supabase (legacy)	JWT with role `service_role`	Create a new secret key in Settings → API Keys, switch your server code to it, then deactivate the legacy keys.
AWS	`AKIA...`	IAM → your user → Security credentials → deactivate, then delete the access key.
GitHub	`ghp_...`	GitHub Settings → Developer settings → Personal access tokens → delete it.

Menu names change from time to time. If you can't find the exact button, search the provider's docs for "revoke API key."

Step 2: Check for damage

AI keys (OpenAI, Anthropic): check usage and billing for spikes. Set a monthly spending limit while you're there.
Stripe: look for refunds, payouts or customers you don't recognise.
Supabase secret / service_role: this key could read or change all your data. Check your tables for rows you didn't create or that went missing.
AWS: check billing and CloudTrail for activity you didn't do, especially new servers. AWS may also have emailed you about the exposed key.

If you find real misuse, contact the provider's support. Many will help with fraudulent charges if you report quickly.

Step 3: Find out how it got there

The most common cause in AI-built apps is the public prefix trap. These environment-variable prefixes are designed to be copied into your website's JavaScript, where anyone can read them:

VITE_...          (Vite, used by Lovable and Bolt)
NEXT_PUBLIC_...   (Next.js)
REACT_APP_...     (Create React App)
EXPO_PUBLIC_...   (Expo)

If your secret key is named something like VITE_OPENAI_API_KEY, it's public, even though it's in a .env file. The other common cause is your AI tool pasting the key straight into a component file.

Step 4: Move the key to the server

Secret keys should only be used in code that runs on a server: an API route, a serverless function, or a Supabase Edge Function. Your website calls your function, and your function calls OpenAI, Stripe and the rest using a key the browser never sees.

Paste this into your AI builder

Security fix: my app exposes a secret API key in front-end code.
1. Find every place a secret key is used in browser code, including any env variable starting with VITE_, NEXT_PUBLIC_, REACT_APP_ or EXPO_PUBLIC_.
2. Move each of those calls into a server-side function (an API route or Supabase Edge Function) that reads the key from a server-only secret or environment variable without a public prefix.
3. Make the front end call my server function instead.
4. Make the server function check the user is logged in and limit how often it can be called.
5. Only publishable keys (Stripe pk_, Supabase sb_publishable_ or anon) may remain in front-end code.
Show me every file you changed.

Then add the new key as a secret in your host (in Vercel: Project → Settings → Environment Variables; in Supabase: Edge Functions → Secrets) and redeploy.

Step 5: Make sure it doesn't happen again

Keep .env files out of Git. Your .gitignore should include .env*.
Turn on GitHub's secret scanning push protection (repo Settings → Advanced Security / Code security) so GitHub blocks pushes containing keys.
Set spending limits on AI providers so a leak can't drain your account.
Rescan your live site after every big change. AI tools can reintroduce the same mistake.

Is removing it from Git history needed? It's tidy, but it doesn't un-leak anything. Copies may already exist. Revoking the key (Step 1) is what actually protects you.

Check whether your live site still leaks

Vibeproof's free scan reads your page and the JavaScript it loads, including lazy-loaded files, and flags exposed secret keys in under a minute.

Scan my app free