Your OpenAI key is in your GitHub repo. Here's what happens next.

One of the most common — and most expensive — things we see in AI-built apps is simple: the secret API key is written straight into the code. The AI tool pasted it there to "make it work," and nobody took it out.

The problem shows up the moment that code lands in a public GitHub repo. There are bots that do exactly one thing all day: scan new commits for keys. They find them in minutes, not days.

What happens when your key is stolen

• An OpenAI key becomes thousands of dollars in calls you never made.
• A Stripe key can be used to touch charges and refunds.
• A database key can mean a full leak of your customers' data.

How to do it right

Secrets never live in the code. They go in environment variables — values that sit outside the repo and only exist on the server. And deleting the key from the code isn't enough: it's still in your Git history. An exposed key has to be revoked and replaced with a new one.

If you think one of your keys might have leaked, assume it did. Revoke it now — then we can help you set this up properly.