An API key works like a credit card issued in your name. If an OpenAI, maps, or payment key sits in your code as plain text, anyone who reads that code can spend on your account. Overnight bills in the millions of won are not rare.
Why does this happen so often in AI-built projects?
AI optimizes for code that runs. Putting the key directly in the source works immediately, nothing looks wrong on screen, and it ships. The catch is that automated scanners find these keys long before any user does.
How do you check whether your code contains keys?
- Search the whole project for sk-, key, secret, and password.
- An actual key value wrapped in quotes inside a code file is a red flag.
- Keys belong only in a .env file, and .env must be listed in .gitignore.
- If you can see the key by opening the browser sources with F12, it is already public.
What do you do first if it has already leaked?
Revoking and reissuing the key comes before removing it from the code. Repository history keeps the old content even after deletion, so a leaked key stays valid until you revoke it. Revoke, reissue, then clean the code, and always review usage and billing on that provider afterwards.
Key handling is a habit, not a skill. Keep keys in configuration rather than in code and half of these incidents disappear.
Keeping a key safe means using it only from a server, which requires something running outside the browser. This is one of the areas an AI assistant reliably struggles to produce on its own.