Exposed API Keys Explained: The #1 Vibe Coding Vulnerability

What Are Exposed API Keys?

An API key is like a password that lets your application access external services. When you use Stripe for payments, OpenAI for AI features, or AWS for cloud services, you get API keys to authenticate your requests.

Exposed API keys occur when these credentials become visible to people who shouldn't have them. This happens in several ways:

• Committed to Git: Keys pushed to public (or even private) repositories
• Hardcoded in frontend: Keys visible in JavaScript that runs in the browser
• Visible in network requests: Keys sent in URLs or headers that anyone can see
• Logged to consoles: Keys printed in error messages or debug output
• Included in build artifacts: Keys bundled into compiled code

Why This Is the #1 Vibe Coding Issue

AI coding assistants are trained on public code, which often includes examples with placeholder API keys. When you ask an AI to integrate Stripe or OpenAI, it generates code with hardcoded values:

// This is what Cursor, Bolt, or Copilot might produce
const stripe = require('stripe')('sk_live_abc123xyz789');
const openai = new OpenAI({ apiKey: 'sk-proj-abcdef123456' });

If you ship this code to production or commit it to GitHub, your keys are exposed. Bots scan for these patterns constantly and will find them within minutes.

How Attackers Find Exposed Keys

Automated Scanning

Attackers run bots that continuously:

• Monitor GitHub's public event stream for new commits
• Search for patterns matching known API key formats
• Scan websites for keys in JavaScript files
• Check browser developer tools and network requests

Key Patterns They Look For

Common Places Keys Get Exposed

1. Frontend JavaScript

// In your React component
const response = await fetch('https://api.openai.com/v1/chat', {
  headers: {
    'Authorization': 'Bearer sk-proj-your-secret-key' // Visible to everyone!
  }
});

2. Git History

Even if you remove a key from your current code, it still exists in your Git history:

# This command shows all previous versions of a file
git log -p --all -S 'sk_live' -- .

# Attackers can find keys you "removed" months ago

3. Environment Files Committed

# This should NEVER be in your repo
STRIPE_SECRET_KEY=sk_live_abc123
DATABASE_URL=postgres://user:password@host/db
OPENAI_API_KEY=sk-proj-xyz789

4. Build Artifacts and Logs

// Debug logging that exposes keys
console.log('Config:', config); // Prints all keys to console
console.log('Request headers:', headers); // Includes auth tokens

How to Fix Exposed API Keys

Step 1: Use Environment Variables

// Server-side code
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

// Never hardcode keys directly!

Step 2: Configure .gitignore

# Environment files
.env
.env.local
.env.*.local
.env.production

# IDE and system files
.idea/
.vscode/
.DS_Store

Step 3: Use Backend for Sensitive API Calls

// Frontend calls YOUR backend
const response = await fetch('/api/generate-text', {
  method: 'POST',
  body: JSON.stringify({ prompt: userInput })
});

// Backend (server-side) calls OpenAI with the secret key
// app/api/generate-text/route.ts
export async function POST(req) {
  const { prompt } = await req.json();
  const response = await openai.chat.completions.create({
    model: 'gpt-4',
    messages: [{ role: 'user', content: prompt }]
  });
  return Response.json(response);
}

Step 4: Rotate Exposed Keys Immediately

If a key has been exposed, you cannot "unexpose" it. You must:

1. Generate a new key in your service provider's dashboard
2. Update your application to use the new key
3. Delete or deactivate the old key
4. Check for unauthorized usage in your billing/logs

Platform-Specific Guidance

What Keys Are Safe in Frontend?

Some keys are designed to be public. These are safe to include in frontend code:

• Stripe Publishable Key (pk_live_...) - Designed for browser use
• Firebase Config - Public by design, secured by rules
• Supabase Anon Key - Public, protected by Row Level Security
• Google Maps API Key - Public, but restrict by domain