Secrets
OpenAI & Anthropic API keys in client code: the new #1 leak
Adding an AI feature is a five-minute job, and that is exactly the problem: the quickest path drops your OpenAI or Anthropic key into code the browser downloads.
Tag
#api-keys
Secrets
Stripe keys in your frontend: live vs. restricted vs. webhook secrets
Stripe gives you several kinds of key, and only one is meant for the browser. Mixing them up is the common mistake — here is which goes where.
Secrets
The most common way API keys leak from production sites
API keys do not usually leak through clever hacks. They leak because a key meant for the server ends up in code the browser downloads. Here is the pattern, and the fix.