Submit a tool
Fixes / Vibe Coding

Before you share your vibe-coded app: check for leaked API keys

Vibe-coded apps often ship API keys in the repo or browser, and agent tooling can expose credentials. Short answer: 5 steps. 1) Search your code for keys; 2) Move secrets to environment variables; 3) Never put secret keys in front-end code; 4) Scan the whole Git history; 5) Rotate anything that leaked.

Last updated:

The problem: Vibe-coded apps often ship API keys in the repo or browser, and agent tooling can expose credentials.
Asked on X: post 1, post 2

How do I fix this?

  1. Search your code for keys

    Look for strings starting with sk-, AIza, ghp_, or words like api_key/secret. Any real key in a source file is a problem.

  2. Move secrets to environment variables

    Put them in .env locally and in the host's dashboard in production. Add .env to .gitignore before your next commit.

  3. Never put secret keys in front-end code

    Variables with a public prefix (VITE_, NEXT_PUBLIC_, PUBLIC_) are shipped to every visitor's browser. Call paid APIs from a server route instead.

  4. Scan the whole Git history

    Deleting a key from the latest file doesn't remove it from history. Run a secret scanner (TruffleHog, GitGuardian) on the repo.

  5. Rotate anything that leaked

    If a key was ever pushed, revoke it in the provider's dashboard and create a new one. Set usage limits/alerts on every paid API key.

Which tools can do this for me?

GitGuardian

Detects secrets in repos and commits; free for individual developers.

TruffleHog

Open-source secret scanner for Git history, files and more.

Semgrep

Static analysis that finds common security bugs in code.

Snyk

Finds vulnerable dependencies and code issues.

Sponsor slot

Open: 1 spot per week

One labeled sponsor for this topic each week; this week's spot is open. See open weeks →

All tools for “Secure a vibe-coded app” →