What is vibe coding and why does it need security scanning?

Vibe coding means using AI tools like Cursor, Bolt, v0, and Lovable to generate code quickly by describing what you want. While fast, AI-generated code often contains security vulnerabilities like XSS, SQL injection, exposed API keys, and missing authentication. OverMCP scans this code and fixes it automatically.

How does OverMCP scan my website?

Paste any live URL or GitHub repo link. OverMCP crawls your site, extracts all code (HTML, JS, CSS), follows source maps to find original source files, and runs 4 parallel AI analyses: security audit, SEO/AEO check, performance audit, and dependency CVE scan.

What is AEO (Answer Engine Optimization)?

AEO makes your website visible and recommendable by AI chatbots like ChatGPT, Claude, and Perplexity. OverMCP checks your AI bot permissions, generates llms.txt files, adds JSON-LD structured data, and optimizes your content for AI comprehension.

What payment methods are accepted?

OverMCP accepts crypto payments including Bitcoin, Ethereum, USDT, and many other cryptocurrencies. This keeps checkout accessible globally without requiring a credit card.

Can OverMCP automatically fix my code?

Yes. The $5 Fix tier creates a GitHub Pull Request with all security fixes applied. The $19 Deploy tier goes further — it deploys the fixed version directly to your hosting platform (Vercel, Netlify, Cloudflare Pages, or Railway) in one click.

API key leakGitHub securityvibe codingsecret leak scannerAI app security

Fix Leaked API Keys in GitHub Repos: Vibe-Code Security Guide

OverMCP Team

July 18, 2026

Quick answer

Leaked API keys in GitHub repos are one of the most common security risks in vibe-coded apps. To fix them, immediately revoke the exposed key, remove it from your git history using git filter-branch or BFG Repo-Cleaner, and add a .gitignore file for .env and config files. Then scan your entire repo with a secret leak scanner to catch any other exposed secrets.

What to check first

Before you panic, run through this checklist to assess the damage:

•[ ] Check if the key is still active: Try using the leaked key to see if it's still valid. For example, if it's an OpenAI API key, make a simple API call. If it fails, it may already be revoked.

•[ ] Review git history: Run git log --oneline to see commits. Look for any that might contain the key.

•[ ] Search your entire repo: Use git grep -i "sk-" (for OpenAI keys) or similar patterns to find all occurrences.

•[ ] Check commit messages and descriptions: Keys can be accidentally included in commit messages.

•[ ] Look at forked repos: If your repo is public, check if any forks exist that might have copied the key.

•[ ] Review CI/CD logs: Keys may have been printed in build logs on GitHub Actions or other CI services.

•[ ] Scan with a secret leak scanner: Use a tool like OverMCP's secret leak scanner to automate the search across your entire repo.

Step-by-step fix

Follow these steps to permanently remove leaked API keys from your GitHub repo and prevent future leaks.

1. Revoke the exposed key immediately

Go to the service provider (e.g., OpenAI, Stripe, AWS) and revoke the compromised key. Generate a new one and store it securely in environment variables (e.g., in Vercel, Netlify, or your hosting platform). Do NOT commit the new key.

2. Remove the key from git history

You need to purge the key from all commits. The safest way is using BFG Repo-Cleaner:

# Clone your repo as a mirror
$ git clone --mirror https://github.com/yourusername/your-repo.git

# Download BFG jar from https://rtyley.github.io/bfg-repo-cleaner/
# Run BFG to remove the key (example: for OpenAI key starting with sk-)
$ java -jar bfg.jar --replace-text passwords.txt your-repo.git

# In passwords.txt, add the leaked key like: sk-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx

# Then clean and push
$ cd your-repo.git
$ git reflog expire --expire=now --all && git gc --prune=now --aggressive
$ git push --force

Alternatively, use git filter-branch:

$ git filter-branch --force --index-filter \
  "git rm --cached --ignore-unmatch .env" \
  --prune-empty --tag-name-filter cat -- --all
$ git push --force --all

3. Add a .gitignore file

Create or update .gitignore to exclude sensitive files:

# .gitignore
.env
.env.local
.env.*.local
*.pem
*.key
config/credentials.yml

4. Reset environment variables

Update your hosting environment with the new key. For Vercel, use the dashboard or CLI:

$ vercel env add OPENAI_API_KEY

5. Force push and notify collaborators

After the history rewrite, force push to GitHub. All collaborators will need to reclone the repo. If others have forked your repo, ask them to delete their forks and refork.

6. Scan your repo again

Run a secret leak scanner to verify no other secrets remain.

Common mistakes

AI coding tools like Cursor, Bolt.new, and Lovable often generate code that includes hardcoded API keys. Here are the most common mistakes:

•Hardcoding keys in example code: AI models sometimes generate example .env files or config files with placeholder keys that developers accidentally commit.

•Committing .env files: Many vibe-coded projects are scaffolded quickly, and the developer forgets to add .env to .gitignore.

•Putting keys in public repos: Indie developers often make their repos public for portfolio or open-source reasons without scrubbing secrets.

•Not using environment variables: AI-generated code may directly embed the key in a config file like config.js or settings.py.

•Pushing to GitHub with personal access tokens: When using AI tools to push code, the token may be exposed in the commit history.

•Assuming `.gitignore` is set up: Many project templates from AI tools don't include a .gitignore file at all.

To avoid these, always run a free AI app security scanner before your first commit.

How to prevent future leaks

•Use a pre-commit hook to scan for secrets: tools like git-secrets or talisman can block commits containing patterns like sk- or AKIA.

•Enable secret scanning on GitHub: Go to your repo Settings > Security > Secret scanning to get alerts for known patterns.

•Use a continuous security monitoring service to get real-time alerts if new secrets are pushed.

•Educate your team (or your future self) about the risks of hardcoding secrets.

FAQ

How do I find leaked API keys in my GitHub repo?

You can manually search with git grep, or use automated tools like OverMCP's secret leak scanner that scan your entire repo for hundreds of patterns.

Can I remove a leaked API key without rewriting history?

No, once a key is pushed to a public repo, you must rewrite history to remove it. Even if you delete the file in a new commit, the key remains in older commits. Use BFG Repo-Cleaner or git filter-branch.

What should I do if my API key was already used by an attacker?

Revoke the key immediately, check your account for any unauthorized usage (e.g., excessive API calls), and contact the provider's support if needed. Also, consider rotating any other keys that might have been exposed in the same commit.