Your secret API keys might be visible to everyone

You might have secret API keys… publicly visible on your website.

To check:

1. Go to your website.
2. Right-click ⇒ “View page source”.
3. Ctrl+F (search), then type sk_, then api_key, then secret.

If you get any results, that is not a good sign…

AI loves putting keys wherever they work. Except that wherever they work = in the bundle = on everyone’s machine, in public.

I run this search on every app I’m handed.

PS: sk_live_ in the page source is your Stripe key, free for the taking. Check that one first.