Leaked secret · AI

Your OpenAI key
is exposed in .env?

Don't panic — but move fast. A committed or client-side OPENAI_API_KEY gives anyone your OpenAI account's API usage — billed directly to you. Rotate it now, then make sure nothing else leaked.

Looks like
OPENAI_API_KEY=sk-… / sk-proj-…

What an attacker can do with a leaked OpenAI key

⚠

Run up thousands in API charges on your card overnight

⚠

Exhaust your rate limits and quotas, breaking your app

⚠

Access your org's usage and project data

Fix it right now — rotate your OpenAI key

  1. 1OpenAI Platform → API keys → revoke the leaked key and create a new one.
  2. 2Update OPENAI_API_KEY in your server env and redeploy.
  3. 3Set a usage limit under Billing → Limits as a safety net.
  4. 4Remove the key from git history and any client bundle.

Removing the key from your latest commit isn't enough — it stays recoverable in git history until you scrub it. We do that (and find anything else you missed) in the free audit.

Not sure what else leaked? We'll scan your whole repo — free, in 48 hours.