Find leaked API keys in your AI-built app (and what to do in the next hour)

Abstract render of a metal key dissolving into orange particles that flow into a dark glass vault

By the FixMyVibe team · Last reviewed 16 October 2026

If a secret API key is in your repository or your frontend bundle, assume it is compromised: rotate it at the provider right away, then move it to a server-side environment variable. Deleting the line from your code does not help, because the key stays in git history.

Scan my repo free (read-only)See an example report

Where keys leak in AI-built apps

  • Hard-coded in source: the AI pasted your key straight into a fetch call so "it works".
  • A committed .env file, often because .gitignore was missing or edited.
  • Behind a public prefix. Next.js inlines NEXT_PUBLIC_ variables into the browser bundle, and Vite exposes VITE_ variables to client code. A secret named NEXT_PUBLIC_OPENAI_KEY is public by definition.
  • Git history: a key that was committed once and removed later is still in every clone.

Why deleting the line is not enough

Git keeps every previous version of every file. GitHub's guidance is to treat a pushed secret as compromised and revoke or rotate it; rewriting history is a secondary step that cannot reach copies other people already made.

Incident playbook: the next hour

  1. Rotate or revoke the key at the provider (Stripe dashboard: roll the key; Supabase: create a new secret key and delete the old one; OpenAI and others: delete the key and create a new one).
  2. Deploy the new key as a server-only environment variable (no NEXT_PUBLIC_/VITE_ prefix) and move the API call to a server route or Edge Function.
  3. Audit usage: check the provider's logs and billing for calls you don't recognize since the key was first committed.
  4. Purge history if needed, following GitHub's guide, once the key is already dead.

Prevent it: push protection and server-side calls

Turn on GitHub secret scanning and push protection for your repository, so pushes containing supported secret types are blocked before they land. Keep a .env.example with placeholder values and .env* in .gitignore. Rule of thumb for prompts to your AI tool: "call this API from a server route; never expose the key to the client".

What FixMyVibe checks (and what it doesn't)

The free scan runs a secret scanner (gitleaks) plus our own rules over the current files of your repository: committed API keys and tokens, Supabase secret/service_role keys, committed .env files, and secrets behind NEXT_PUBLIC_/VITE_/REACT_APP_/EXPO_PUBLIC_ prefixes. It does not scan git history and does not check your live site, so a key that was removed from the code but is still in history will not show up. For that, use GitHub secret scanning, which also covers history.

Scan my repo free (read-only)See an example report

FAQ

Is a Stripe publishable key a leak?

No. Stripe publishable keys (pk_live_, pk_test_) are meant for client-side code. Stripe says only publishable keys are safe to expose; secret keys (sk_) and restricted keys (rk_) must stay on your server.

I deleted the key from my code. Am I safe?

No. The key is still in your git history and may already have been copied. Rotate or revoke it at the provider first; cleaning history comes after that, if at all.

Which keys are safe in the frontend?

Only keys designed to be public: the Supabase publishable (anon) key and the Stripe publishable key. Everything else (Stripe secret keys, OpenAI/Anthropic keys, Supabase secret/service_role keys, webhook signing secrets) belongs on a server.

Does FixMyVibe store my secrets?

No. The repository is cloned into a temporary directory and deleted when the scan finishes. Findings point to the file and line and describe the type of key; we don't keep secrets. Details are in our privacy policy.

How do I remove a key from git history?

Rotate the key first. Then, if you need to, follow GitHub's guide 'Removing sensitive data from a repository' (git filter-repo). Rewriting history affects every clone and fork, and does not un-leak a key that was already copied, which is why rotation comes first.

Sources

FixMyVibe is an automated code scan, not a full penetration test, and cannot guarantee that an app is secure. What happens to your code during a scan: see our privacy policy.