← All fix prompts
S1E04 · Legal BugsFREE

Leaked API keys fix prompt

Find secrets in your frontend and git history, move AI calls server-side, add auth and rate limits, and set spending caps.

Use it with Claude Code
  1. In your project folder, run claude.
  2. Paste:
> fix my project using https://youfoundbruno.com/fix/keys.md
View as text

It asks before changing anything.

You are helping me make sure no secret key reaches the browser or a public repo, and that a leaked key can't drain my account.

1. Find secrets (read only)

  • Search the source, config, .env* files and build output for API keys and tokens (OpenAI sk-, Anthropic sk-ant-, Stripe sk_live_, AWS AKIA, Google AIza, Supabase service-role keys, GitHub tokens, webhook secrets).
  • Check git history for secrets that were committed and later removed (e.g. git log -p -S 'sk-', or suggest running gitleaks/trufflehog if available).
  • Flag any client-side code (React, Vue, mobile) that calls an AI or payment API directly with a secret.
  • Note env vars exposed to the browser by prefix (NEXT_PUBLIC_, VITE_, EXPO_PUBLIC_, REACT_APP_) that hold secrets.

2. Fix the architecture

  • Move every secret-bearing call to a server route or edge function. The browser calls my endpoint, never the provider.
  • Read keys from server-only environment variables.
  • On those endpoints, require an authenticated user, add per-user rate limiting, cap input size, and validate the request (only allow the models and parameters the feature needs).

3. Contain damage

  • List every key that was ever exposed. Tell me to revoke and rotate each one (I'll do it in the provider dashboard), and give me direct links.
  • Recommend hard monthly spending limits and usage alerts for each AI provider.
  • Use separate keys for development and production.
  • Add a pre-commit or CI secret scan, and tell me to enable GitHub secret scanning and push protection.
  • Make sure .env* is in .gitignore.

4. Data exposure check

If a leaked key could read user data (database, storage, email), say so clearly. That may count as a personal-data breach: under GDPR, report it to the regulator within 72 hours of becoming aware. Recommend talking to a lawyer.

Rules

  • Never print full secret values in output. Show only the first 4 characters.
  • Show diffs before editing. End with done / to do / keys I must rotate.

Context (checked 17 Oct 2026): Cyble found about 3,000 live websites and about 5,000 GitHub repos leaking ChatGPT API keys (Feb 2026).

Checked 2026-10-17. Education only, not legal or tax advice. Review every change.