Exposed API Keys Explained: The #1 Vibe Coding Vulnerability

What Are Exposed API Keys?

An API key is like a password that lets your application access external services. When you use Stripe for payments, OpenAI for AI features, or AWS for cloud services, you get API keys to authenticate your requests.

Exposed API keys happen when those credentials become visible to people who shouldn't have them:

• Committed to Git: Keys pushed to public (or even private) repositories
• Hardcoded in frontend: Keys visible in JavaScript that runs in the browser
• Visible in network requests: Keys sent in URLs or headers that anyone can see
• Logged to consoles: Keys printed in error messages or debug output
• Included in build artifacts: Keys bundled into compiled code

Why This Is the #1 Vibe Coding Issue

AI coding assistants are trained on public code, which often includes examples with placeholder API keys. When you ask an AI to integrate Stripe or OpenAI, it generates code with hardcoded values:

// This is what Cursor, Bolt, or Copilot might produce
const stripe = require('stripe')('sk_live_abc123xyz789');
const openai = new OpenAI({ apiKey: 'sk-proj-abcdef123456' });

If you ship this to production or push it to GitHub, your keys are exposed. Bots scan for these patterns constantly and will find them within minutes. Sometimes seconds.

How Attackers Find Exposed Keys

Automated Scanning

Attackers run bots against GitHub's public event stream, watching for new commits in real time. The bots match known API key patterns, scan website JavaScript, and trawl network request logs. You don't need to be a high-profile target. Volume is the point.

Key Patterns They Look For

Common Places Keys Get Exposed

1. Frontend JavaScript

// In your React component
const response = await fetch('https://api.openai.com/v1/chat', {
  headers: {
    'Authorization': 'Bearer sk-proj-your-secret-key' // Visible to everyone!
  }
});

2. Git History

Even if you remove a key from your current code, it still exists in your Git history:

# This command shows all previous versions of a file
git log -p --all -S 'sk_live' -- .

# Attackers can find keys you "removed" months ago

3. Environment Files Committed

# This should NEVER be in your repo
STRIPE_SECRET_KEY=sk_live_abc123
DATABASE_URL=postgres://user:password@host/db
OPENAI_API_KEY=sk-proj-xyz789

4. Build Artifacts and Logs

// Debug logging that exposes keys
console.log('Config:', config); // Prints all keys to console
console.log('Request headers:', headers); // Includes auth tokens

How to Fix Exposed API Keys

Step 1: Use Environment Variables

// Server-side code
const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);
const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

// Never hardcode keys directly!

Step 2: Configure .gitignore

# Environment files
.env
.env.local
.env.*.local
.env.production

# IDE and system files
.idea/
.vscode/
.DS_Store

Step 3: Use Backend for Sensitive API Calls

// Frontend calls YOUR backend
const response = await fetch('/api/generate-text', {
  method: 'POST',
  body: JSON.stringify({ prompt: userInput })
});

// Backend (server-side) calls OpenAI with the secret key
// app/api/generate-text/route.ts
export async function POST(req) {
  const { prompt } = await req.json();
  const response = await openai.chat.completions.create({
    model: 'gpt-4',
    messages: [{ role: 'user', content: prompt }]
  });
  return Response.json(response);
}

Step 4: Rotate Exposed Keys Immediately

If a key's already out there, you can't unexpose it. Do this now:

1. Generate a new key in your service provider's dashboard
2. Update your app to use the new key and deploy
3. Delete or revoke the old key
4. Review your billing and logs for unauthorized usage

Platform-Specific Guidance

What Keys Are Safe in Frontend?

Some keys are designed to be public. These are actually safe to ship in the browser:

• Stripe Publishable Key (pk_live_...) - Designed for browser use
• Firebase Config - Public by design, secured by rules
• Supabase Anon Key - Public, protected by Row Level Security
• Google Maps API Key - Public, but restrict by domain