Your app needs to talk to other services: the database, email, payments, an AI model. Each of them gives it a long code to prove it’s allowed in. That code is called an API key, token or secret.
Unlike a person’s login, there’s usually no two-step sign-in behind it. Whoever has the code is your system, as far as that service is concerned.
What goes wrong
- It ends up in the browser. Everything in the part of an app that runs on a visitor’s screen can be read by that visitor. A key placed there has effectively been published. AI tools can do this when asked to “just make it work”.
- It ends up in the code history. A key that was committed to a public GitHub repository can be found within minutes by automated scanners. Deleting it later doesn’t help, since the history is still there.
- It gets pasted around. Keys turn up in chat messages, spreadsheets and emails, and in the conversation with the AI tool itself.
- Nobody ever changes it. The freelancer who left two years ago may still have a key that works.
What could happen
A database key
Someone can read, change or delete all your data, and it looks like normal use.
An email key
Someone sends spam or phishing from your domain, at your expense and to the cost of your reputation.
An AI or cloud key
Someone runs up a bill on your account, sometimes a very large one, very quickly.
A payment key
Depending on what it allows, someone could see transactions or issue refunds.
Not every key is a secret
Some keys are designed to be visible. A Supabase “anon” or “publishable” key is one, because the access rules do the protecting, and a Stripe “publishable” key is another. The ones that must never be visible usually have names including service, secret or admin.
How to check yours
- List your keys. Note each service the app connects to, and where its key is stored.
- Look at the settings. Good tools have a secrets or environment variables section. Keys should be in there, rather than in the code. If you’re unsure, ask the AI tool where each key is stored, and check what it says.
- Look at what the browser receives. On a computer, open your app, press Ctrl+U (or View Source on a Mac) and search for words like secret, service_role or sk_. Finding nothing doesn’t prove you’re safe, because the code can be split over several files, but finding one is a problem.
- Check the code host. If your code is on GitHub, is the repository private? GitHub’s own secret scanning may have sent warnings to the owner’s email.
If a key has leaked
- Replace it now. Create a new key at the service, put it in the app’s secure settings, check that the app still works, then delete the old key. Merely removing the old one from the code isn’t enough. Treat it as seen.
- Look at the logs and the bill. Is there any unexplained use, new administrator, or unusual spending?
- Work out what it could reach. If it could reach personal data, take advice on whether you need to report it. There’s a 72-hour clock if it’s reportable.
- Find out how it got there, so that it doesn’t happen again next time someone asks the AI tool for a quick fix.
Questions
How often should we change keys?
Always when someone with access leaves, and whenever you suspect a leak. Beyond that, a regular change, say yearly, is a sensible habit for the powerful ones.
Is it safe to paste a key into an AI chat?
It’s best avoided. Use the tool’s own secrets feature, so that the key stays out of the conversation and out of the code.
By Selwyn Doling, VibeTend. Last updated 6 November 2026.
