Secrets
GitHub tokens explained: PAT classic, fine-grained, OAuth — and their blast radius
All three are 'a GitHub token,' but a leaked one can mean very different things — from a single repo to your entire account. The difference is scope.
Tag
#api-keys
Secrets
OpenAI & Anthropic API keys in client code: the new #1 leak
Adding an AI feature is a five-minute job, and that is exactly the problem: the quickest path drops your OpenAI or Anthropic key into code the browser downloads.
Secrets
Stripe keys in your frontend: live vs. restricted vs. webhook secrets
Stripe gives you several kinds of key, and only one is meant for the browser. Mixing them up is the common mistake — here is which goes where.
Secrets
The most common way API keys leak from production sites
API keys do not usually leak through clever hacks. They leak because a key meant for the server ends up in code the browser downloads. Here is the pattern, and the fix.