← All solutions
Solutions
My app's secret keys are visible in the browser
AI coding assistants put passwords and keys where they're convenient, not where they're safe. If your OpenAI, Stripe or database key was ever written into front-end code, anyone who opens their browser's developer tools can read it — and it stays compromised until you replace it.
Does this sound familiar?
- A key is written directly into a page, a config file, or anything under src/
- A setting named VITE_…, NEXT_PUBLIC_… or REACT_APP_… holds a password or key — those names are published to the browser on purpose
- A .env file was saved into your code history
- Your AI provider bill jumped without a matching jump in users
What it costs to leave it
- Anyone can spend against your AI provider account until the limit runs out
- An admin-level database key ignores every access rule you've written
- Replacing the key later doesn't undo what was taken while it was live
- Your code history keeps the key even after you delete the file
What good looks like
- No key ever reaches the browser — calls to OpenAI, Stripe and the like run on your server
- Keys are stored encrypted, replaced regularly, and limited to what they need to do
- The only keys in the browser are the public kind, meant to be seen
- Old keys are switched off rather than just replaced, and cleared from your code history
The job that fixes this
Fix & Secure an AI-Built App
We find what's exposed or broken, replace the passwords and keys that leaked, lock the database down so customers can't reach each other's data, and get the app back to something you can safely launch. Most rescues land between $700 and $1,200; small, contained ones start at $350.
From $350 · 1 – 3 days