Leaked API keys in Lovable and Bolt apps: find them and fix them

Updated 16 October 2026 · ShipMender guides

An exposed secret key is one of the most serious, and most common, problems in AI-built apps. Here's how it happens, how to check, and exactly what to do if you find one.

Public keys vs secret keys

Some keys are meant to be public. Others must never leave a server.

• Fine in the browser: Supabase anon key (when RLS is set up properly), Stripe publishable key (pk_live_…).
• Never in the browser: Supabase service_role key, Stripe secret key (sk_live_…) and restricted keys, OpenAI and Anthropic API keys, Resend or SendGrid keys, database connection strings.

How secret keys leak in vibe-coded apps

Pasted into the chat

Asking an AI tool to "connect OpenAI" and pasting the key often results in it being written straight into a React component.

Wrong environment variable prefix

Variables starting with VITE_, NEXT_PUBLIC_ or REACT_APP_ are bundled into the browser code. Putting a secret behind one of these prefixes publishes it.

Committed to GitHub

A .env file pushed to a public repo, even briefly, stays in Git history.

How to check your app

• Open your live site, view the page source and the JavaScript files in your browser's developer tools, and search for sk_, service_role and key.
• Search your repo and its history with a tool like gitleaks.
• Check your environment variable names for public prefixes on secrets.

If a key has leaked

1. Rotate it first. Generate a new key in the provider's dashboard and revoke the old one. Removing it from code isn't enough.
2. Move the new key to server-side code: a Supabase edge function, an API route or your host's secret settings.
3. Check the provider's logs and billing for unexpected use.
4. If it was a database key, check your data for unexpected changes.

Prompt to fix it

Find every API key or secret in this project. For any secret key in client-side code or in a VITE_/NEXT_PUBLIC_ variable, move the call that uses it into a server-side function and read the key from a server-only environment variable. List the keys I need to rotate.