When to use it
Before launch, and any time you add a feature that calls a paid API. It’s very common for an AI builder to call an AI model straight from the browser, with the key right there in the code. Anyone who opens the browser’s developer tools can copy it and run up your bill.
Public keys are fine where they are: Stripe publishable keys (starting pk_) and Supabase anon or publishable keys are designed to be visible.
What to check afterwards
- Open your live app, open the developer tools and search the loaded scripts for the start of each secret key, such as
sk_. Nothing should be found. - Use the feature that called the API, to make sure it still works through the server.
Don’t skip this part
If a secret key was ever in the browser code, assume someone has it. Create a new key in that provider’s dashboard, put the new one in your server secrets and delete the old one. Then set a monthly spending limit in that provider’s dashboard too.
The full background is in our guide: Is your vibe-coded app leaking data? 5 things to check.