Guide3 min readUpdated 2026-08-10

An API key leaked — what to do right now

Rotate first, read second. The order matters more than anything else on this page.

Automated scanners watch public repositories and deployed JavaScript continuously. Keys found there are used within minutes, not days, so speed matters more than diagnosis.

The order that limits the damage

Same five steps for every provider

  1. 1Revoke the key at the provider. Confirm it is revoked, not merely replaced.
  2. 2Work out what that specific key could do — money, data, or infrastructure.
  3. 3Check the provider's logs and billing for activity you did not cause.
  4. 4Find how it leaked: client code, a mis-prefixed environment variable, or a committed file.
  5. 5Check for persistence — a second key or user the attacker created, which rotating the first key does nothing about.
Find the rest before they leak too
Find every hardcoded credential in this project.

1. Search all files — client code, config, and git history — for strings
   starting sk-, sk-ant-, sk_live_, AKIA, ASIA, ghp_, SG., and any variable
   named *_SECRET, *_TOKEN, *_API_KEY, *_PASSWORD.
2. For each, tell me the file, the line, and whether that code runs in the
   browser or on the server.
3. Separate the public-by-design keys (Supabase anon, Firebase apiKey,
   Stripe publishable) from real secrets.
4. Move every real secret to a server-only environment variable — never a
   VITE_, NEXT_PUBLIC_ or REACT_APP_ prefix, which are compiled into the
   browser bundle.
5. Tell me explicitly which ones appear in git history, because those must
   be rotated regardless of what I do to the code.

This is one check out of 40+

Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.

Check my site — free