Fixes · Security holes

OpenAI or Anthropic API key exposed in the browser

An AI client created with dangerouslyAllowBrowser, or a key behind a VITE_ or NEXT_PUBLIC_ prefix, puts your API key in the page, where anyone can copy it and spend on your account.

Most common in apps built with Lovable, Bolt, v0.

What you see

The OpenAI or Anthropic client is created in a component, with dangerouslyAllowBrowser: true, or the key is read from VITE_OPENAI_API_KEY or NEXT_PUBLIC_….

Why it happens

Anything the browser runs, every visitor can read. A public prefix means the value is bundled into the JavaScript everyone downloads.

How to fix it

  1. Revoke the key in the provider's dashboard now: it has already shipped.
  2. Call the AI from a server route that holds a new key (without a public prefix).
  3. Have the browser call that route, and limit how often each user can.

Or ask your AI tool to fix it

Paste this into Lovable, Bolt, v0, Replit or Cursor, and let it make the change.

The AI API key is exposed in the browser. Move every AI call to a server-side API route that reads the key from a server-only environment variable (no VITE_ or NEXT_PUBLIC_ prefix), have the browser call that route, and add a per-user rate limit. Then tell me to revoke the old key.

Don't change what the app does.
Never put a secret key or password in the code: read it from an environment variable.
If a step has to be done outside the code, like revoking a key in a provider's dashboard, list it for me at the end instead of skipping it.

How Launchpad helps

The launch check finds both patterns, and never shows the key itself, only where it is.

Check your app for this, freeJoin the waitlist

Related