Get secret keys out of your frontend
Find API keys that ship to the browser or sit in your git history, move them to the server, and rotate them.
Skip to the promptWho needs this
- Your app calls paid or private APIs (Stripe, OpenAI, Anthropic, email, SMS, databases).
- You've ever put a key in a file that's sent to the browser or committed it to git.
Why it matters
- Anything in your frontend bundle is visible to every visitor, including environment variables prefixed with VITE_, NEXT_PUBLIC_, REACT_APP_ or EXPO_PUBLIC_.
- A leaked secret key lets anyone spend your money (stolen AI and SMS keys are often abused within hours) or read your users' data, which can become a reportable personal data breach.
- Deleting a key from the code doesn't remove it from git history: anyone with the repository can still find it. Rotation is the only fix.
Before you paste
- Access to each provider's dashboard so you can rotate keys afterwards.
- Your hosting provider's settings for server-side environment variables.
The prompt
Copy it into your AI builder. Fill in anything in [brackets] first, and review every change before you ship it.
Find secrets exposed to the browser or committed to this repository, and fix them. 1. FIND THEM - Search the code and config for secret-looking values and variable names: Stripe secret keys (sk_live_, sk_test_, rk_live_), OpenAI (sk-) and Anthropic (sk-ant-) keys, Supabase service-role keys, database URLs with passwords, webhook signing secrets, JWT secrets, AWS keys (AKIA), private keys (BEGIN PRIVATE KEY). - List every environment variable with a public prefix (VITE_, NEXT_PUBLIC_, REACT_APP_, EXPO_PUBLIC_, PUBLIC_) and say whether its value is safe to be public. - Check whether .env files are tracked by git, and search the git history for the patterns above (git log -p, or suggest running gitleaks or trufflehog). 2. MOVE THEM TO THE SERVER - For each secret used in browser code, create a server-side route or function that makes the call, and have the browser call that instead. Validate inputs and check the user is signed in where relevant, so the route can't be abused as an open proxy. - Read secrets from server-only environment variables. 3. KEEP PUBLIC KEYS PUBLIC - Stripe publishable keys (pk_), the Supabase anon key and similar client keys are meant for the browser. Leave them. 4. PREVENT IT HAPPENING AGAIN - Add .env, .env.local and .env.*.local to .gitignore and remove tracked .env files from git (keep an .env.example with names only). - Suggest a pre-commit or CI secret scan. 5. ROTATION LIST - Give me a table of every key that was exposed (in the bundle or in git history), the provider, and the link to rotate it. I'll rotate them all. When you're done: list every file you changed, explain each change in one line, and give me a step-by-step test for each numbered item above. Don't change anything unrelated.
Builder tips
Lovable
Store secrets in your Supabase Edge Function secrets (or Lovable's secrets settings), never in the frontend code Lovable writes.
Cursor
Ask it to show the built bundle's size before and after: moving an AI SDK to the server often shrinks the frontend too.
Claude Code
Start in plan mode (Shift+Tab) so you approve the plan before any file changes, then let it run the checks it lists.
Common mistakes
- Renaming VITE_OPENAI_KEY to something less obvious: it's still in the bundle.
- Deleting the key from the code without rotating it.
- A server route that forwards any request to the AI provider without checking who's calling.
Check it worked
- 1Build the app (npm run build) and search the output folder: grep -r -E 'sk_live|sk-ant-|sk-[A-Za-z0-9]{20}|service_role|AKIA' dist (or .next, build, out). No results.
- 2Open the site, DevTools → Sources, and search all files for the same patterns: nothing.
- 3Run git ls-files | grep .env: only .env.example appears.
- 4Rotate every key on the list at its provider, then confirm the app still works with the new server-side keys.
What a SafeLaunch scan adds
SafeLaunch's code scan detects exposed credentials and keeps them out of everything it stores, and maps security gaps to each market's breach rules.
One free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked. No spam, unsubscribe in one click.
By signing up you agree to get this weekly email. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
Questions
Sources
General guidance for common problems, not legal advice. Whether a rule applies depends on where you operate, who your users are and the size of your business.