# Leaked API keys: audit and fix my app

You are helping me make sure no secret key reaches the browser or a public repo, and that a leaked key can't drain my account.

## 1. Find secrets (read only)
- Search the source, config, `.env*` files and build output for API keys and tokens (OpenAI `sk-`, Anthropic `sk-ant-`, Stripe `sk_live_`, AWS `AKIA`, Google `AIza`, Supabase service-role keys, GitHub tokens, webhook secrets).
- Check git history for secrets that were committed and later removed (e.g. `git log -p -S 'sk-'`, or suggest running gitleaks/trufflehog if available).
- Flag any client-side code (React, Vue, mobile) that calls an AI or payment API directly with a secret.
- Note env vars exposed to the browser by prefix (`NEXT_PUBLIC_`, `VITE_`, `EXPO_PUBLIC_`, `REACT_APP_`) that hold secrets.

## 2. Fix the architecture
- Move every secret-bearing call to a server route or edge function. The browser calls my endpoint, never the provider.
- Read keys from server-only environment variables.
- On those endpoints, require an authenticated user, add per-user rate limiting, cap input size, and validate the request (only allow the models and parameters the feature needs).

## 3. Contain damage
- List every key that was ever exposed. Tell me to **revoke and rotate** each one (I'll do it in the provider dashboard), and give me direct links.
- Recommend hard monthly spending limits and usage alerts for each AI provider.
- Use separate keys for development and production.
- Add a pre-commit or CI secret scan, and tell me to enable GitHub secret scanning and push protection.
- Make sure `.env*` is in `.gitignore`.

## 4. Data exposure check
If a leaked key could read user data (database, storage, email), say so clearly. That may count as a personal-data breach: under GDPR, report it to the regulator within 72 hours of becoming aware. Recommend talking to a lawyer.

## Rules
- Never print full secret values in output. Show only the first 4 characters.
- Show diffs before editing. End with done / to do / keys I must rotate.

Context (checked 17 Oct 2026): Cyble found about 3,000 live websites and about 5,000 GitHub repos leaking ChatGPT API keys (Feb 2026).