By Get an engineer for this one. Revoke the key yourself now, then get the calls moved server-side.
- How serious
- Critical
- Fix it yourself?
- No, get an engineer
- Typical cost
- €99–$990 for a single fix (prices)
- Top rated for Lovable
- Afterbuild Labs · 10.0/10
What you see. OpenAI usage jumped overnight, and the API key sits in the browser code or in a NEXT_PUBLIC_ or similar public variable.
Why it happens
Everything the browser downloads is public. If the AI put your OpenAI key into the frontend, into a NEXT_PUBLIC_ variable, or into any file the browser loads, anyone can open the page source and copy it. Bots scan live sites for exactly this. They then run their own workloads on your account until the key is revoked or your spend limit stops them.
OpenAI's guidance is plain: never deploy your key in client-side environments like browsers or mobile apps, and route requests through your own backend server. Builders reach this state because calling OpenAI straight from the browser is the shortest code path, and the preview works. There is no way to hide a key in a frontend. Rotating to a new key and leaving the code as it is just leaks the new key.
Fix it yourself
- Revoke the key right now on the OpenAI API keys page. Your AI feature stops until step four. Do not create the replacement until the code is fixed.
- On the OpenAI Limits page set a hard spend limit and a spend alert. The hard limit stops traffic when the cap is reached. Review the usage page to see how much was taken.
- Search your repository, including old commits, for the key string. A key that was ever committed stays in the history, so treat it as leaked even after removal.
- Have the call moved to a server: a Supabase Edge Function, a Lovable Cloud function, a Next.js route handler, or a Netlify or Vercel function. The new key lives in that host's secret settings with no public prefix.
- Add per-user limits before switching it back on: require sign-in and cap requests per user per day. This is check COST-01.
- Check your other keys the same way, especially the Supabase secret key and the Stripe secret key. See Stripe secret key in my frontend.
When to get an engineer
This is not a do-it-yourself code fix. Moving the call to a server, adding auth checks, and setting per-user limits touches several files and needs testing. Tell the engineer which features use the key, which host you deploy to, and that the key was leaked. Expect €99–$990 and two to four days. Ask them to also scan the bundle for any other secret, which is check DATA-02 on the checklist.
Top-rated companies for Lovable apps
Ranked by our score: published prices, scope of work, AI tools named, timing and a low-risk first step. How we score.
- 1Afterbuild Labs10.0/10Best for: A check before launchFree first step · from $49
- 2Redlab10.0/10Best for: A full rescue by one team that keeps buildingFree first step · from $490
- 3Vibe Code Rescue (Lev Arakelyan)9.0/10Best for: A one-off check and a cleanupFrom $299
Check these
No secret keys reach the browser
Open your live app, then DevTools, Sources, and search the loaded JavaScript for sb_secret_, sk_live_, sk-proj- and sk-ant-. Older Supabase keys are long tokens starting with eyJ: decode the middle part of each on your own machine, and if it contains "role":"service_role", your secret key is public. A publishable or anon key in the browser is expected.
Secrets live in the host's environment settings
Keys belong in environment variables on the server, not in the repository or in front-end code.
AI and paid API calls have per-user limits
Without a cap, one user or one bot loop can spend your monthly budget in an hour.
Sign-in and sign-up are rate limited
Without limits, bots create thousands of accounts and run up your email and AI bills.
Questions
Can I keep the code and just make a new key?
No. The new key ends up in the same public place. The call has to move to a server you control before any key goes back in.
Is the Supabase anon or publishable key the same problem?
No. That key is designed to be public, and row level security does the protecting. The Supabase secret key and the OpenAI key must never reach the browser.
Sources: OpenAI: best practices for API key safety; OpenAI: rate limits and spend limits; OpenAI: production best practices.