Fix Exposed API Keys in Vibe Coded Apps: A Step-by-Step Guide

Quick answer

Exposed API keys in vibe-coded apps are a critical security risk that can lead to unauthorized access, data breaches, and financial loss. To fix them: identify all exposed keys using a secret scanner, revoke and rotate the leaked keys immediately, move them to environment variables or a secrets manager, and implement a monitoring strategy to prevent future leaks. This guide walks you through the entire process, from detection to prevention.

What to check first

Before you panic, run through this checklist to gauge the damage and prioritize your response:

Step-by-step fix

1. Detect exposed keys

Use a secret scanner to automatically find keys in your codebase. OverMCP's secret leak scanner can scan your GitHub repo or local files for patterns like sk-, AKIA, etc. Alternatively, you can use grep for a quick check:

grep -r "sk-\|AKIA\|AIza" . --exclude-dir=node_modules --exclude-dir=.git

If you find matches, note the file and line number.

2. Rotate the keys immediately

Once you've confirmed a leak, revoke the key from the service provider and generate a new one. For example, with Stripe:

For AWS, you can deactivate the access key in IAM and create a new one.

3. Move secrets to environment variables

Never hardcode secrets in your source code. Instead, use environment variables. In a Next.js app, you'd create a .env.local file:

STRIPE_SECRET_KEY=sk_live_...
OPENAI_API_KEY=sk-...

Then reference them in your code:

const stripe = require('stripe')(process.env.STRIPE_SECRET_KEY);

In Vercel, you can add these via the Dashboard or CLI, and they'll be injected at runtime.

4. Add a pre-commit hook

To prevent future leaks, add a tool like git-secrets or a pre-commit hook that scans for known patterns. For example, using husky and lint-staged:

{
  "husky": {
    "hooks": {
      "pre-commit": "lint-staged"
    }
  },
  "lint-staged": {
    "*.{js,ts,jsx,tsx}": ["secret-scan"]
  }
}

5. Monitor and rotate periodically

Even after fixing, regularly scan your repo and use a continuous security monitoring service to alert you if new keys leak.

Common mistakes

FAQ

How do I know if my API key has been leaked?

If you've committed it to a public repo, assume it's leaked. Check for unusual activity in the service dashboard, like unexpected API calls or charges. Use a secret scanner to detect patterns.

Can I just delete the repo to fix a leaked key?

No. Deleting the repo doesn't revoke the key. You must rotate the key at the provider. Even if the repo is private, it's best to rotate.

How often should I rotate my API keys?

It's good practice to rotate keys every 90 days, especially for production. Also rotate immediately after any suspected leak or when a developer with access leaves.

---

For a comprehensive check of your app's security, use OverMCP's free AI app security scanner to catch other vulnerabilities like missing security headers or SSL issues. And remember, prevention is better than cure—integrate scanning into your workflow early.

If you're deploying on Vercel, you can also use OverMCP's Vercel security scanner to automatically monitor your deployments for exposed secrets.