SecurityEnv varsAPI keys

My API secret is in the browser bundle

Secret key visible in DevTools / page source (OpenAI, Stripe, Supabase secret key)

In short: Anything in client-side code, including NEXT_PUBLIC_ and VITE_ variables, is downloadable by anyone. Treat that key as compromised.

Why it happens

Vibe-coded apps often call OpenAI, Stripe, or the database admin API straight from React to make the demo work. The OpenAI SDK even requires dangerouslyAllowBrowser: true for this, which is the warning sign. Once deployed, anyone can open DevTools → Network and copy the key.

How to fix it

1. Rotate the key now in the provider dashboard (OpenAI, Stripe, Supabase, etc.). Deleting it from code doesn't un-leak it.
2. Move the call to a server: a Next.js route handler, a Vercel/Netlify/Cloudflare function, or a Supabase Edge Function. The browser calls your endpoint, your endpoint calls the provider.
3. Store the new key only as a server-side env var (no NEXT_PUBLIC_ / VITE_ prefix).
4. Add basic abuse protection to that endpoint: require login, rate-limit, and cap request size.
5. Search git history for the old key. If the repo is public, assume it was scraped.

Copy-paste fix prompt

I'm getting this error in my app:

Secret key visible in DevTools / page source (OpenAI, Stripe, Supabase secret key)

[Paste the full error, stack trace, and the file it points to here]

Likely cause: Anything in client-side code, including NEXT_PUBLIC_ and VITE_ variables, is downloadable by anyone. Treat that key as compromised.

Task: Find every place a secret API key is used in browser code. Move each call into a server-side endpoint that reads the key from a server-only env var, and update the frontend to call that endpoint. List the keys I need to rotate.

Rules:
- First explain the root cause in 2 sentences and list the files you'll change.
- Make the smallest change that fixes it. Don't refactor unrelated code.
- Don't disable security or checks (RLS, auth, signature verification, type checking, CORS allow-all) to make the error disappear.
- Never print or hard-code secret keys.
- Finish by telling me exactly how to verify the fix.

Common with: Lovable, Bolt, Cursor, v0, Replit. Last reviewed 2026-11-13.