Secrets
OpenAI & Anthropic API keys in client code: the new #1 leak
Adding an AI feature is a five-minute job, and that is exactly the problem: the quickest path drops your OpenAI or Anthropic key into code the browser downloads.
Tag
#secrets
Vibe Coding
Prompt your way to a secret leak: how AI tools commit your .env
An AI assistant does what you ask, including the parts you did not think to forbid. That is how a .env full of keys ends up committed or served.
Secrets
Stripe keys in your frontend: live vs. restricted vs. webhook secrets
Stripe gives you several kinds of key, and only one is meant for the browser. Mixing them up is the common mistake — here is which goes where.
Exposed Files
appsettings.json & secrets.json: the .NET secrets you did not mean to ship
In .NET apps, configuration lives in JSON files that can hold connection strings and keys. When one ends up in a public path, it is a plain URL away.
Secrets
How AWS access keys leak — and what attackers do in the first 5 minutes
An AWS access key has a recognizable shape, which makes it easy for bots to spot. Here is where they leak from and what typically happens right after.
Exposed Files
.env exposed: how a single file hands attackers your whole stack
The .env file holds your database URLs, API keys and tokens. It belongs on the server — but when it ships to a public folder, anyone can just download it.
Secrets
The most common way API keys leak from production sites
API keys do not usually leak through clever hacks. They leak because a key meant for the server ends up in code the browser downloads. Here is the pattern, and the fix.
Vibe Coding
I shipped an app with AI in a weekend — here is what the scanner found
We built a small app the vibe-coding way, deployed it, then scanned it. Here is the honest list of what came back, and what each finding actually meant.
Vibe Coding
Security for vibe coders: the 7 things AI-generated apps leak first
AI writes the code that solves your prompt — not the code that keeps secrets. Here are the 7 things vibe-coded apps leak first, and how to catch them before bots do.