Prompt: get API keys out of your frontend
Finds every hardcoded key, separates the public-by-design ones from the real secrets, and relocates the rest.
AI coding tools put the key where the code that needs it lives. When that code runs in the browser, so does the key. The nuance worth keeping: some keys belong in the browser, and treating those as incidents wastes your time.
Copy this into Cursor, Claude Code, Lovable or your builder
Find every credential in this project and move the secret ones server-side.
1. Search all files for hardcoded credentials: strings starting sk-,
sk-ant-, sk_live_, rk_live_, AKIA, ASIA, ghp_, SG., and any variable
named *_SECRET, *_TOKEN, *_API_KEY, *_PASSWORD.
2. For each hit, classify it and tell me which it is:
- PUBLIC BY DESIGN, leave alone: Supabase anon key, Firebase apiKey,
Stripe publishable key (pk_), any *_PUBLIC_* value.
- REAL SECRET, must move: everything else.
3. For every real secret, move the provider call to the server — an API
route, a server action, or a Supabase Edge Function — and have the
frontend call that instead.
4. Read secrets from server-only environment variables. Never use a
client-exposed prefix: VITE_, NEXT_PUBLIC_ and REACT_APP_ are compiled
into the browser bundle by design.
5. Check git history as well as current files, and tell me if a secret
appears there — removing it from HEAD does not remove it from history.
Output a table: secret, file, browser or server, action taken. I will
rotate every real secret you find.What your AI should do with it
- A clear split between keys that are fine in the browser and keys that are not — no false alarms about your Supabase anon key.
- Provider calls moved to server code, not just the variable renamed.
- A warning if a secret is in git history, which relocating does not solve.
How to check it worked
Search your live bundle
- 1Open your deployed app, press F12, Sources tab.
- 2Search all files (Ctrl+Shift+F) for: sk- then sk_live then service_role then AKIA
- 3Zero results means the bundle is clean.
This is one check out of 40+
Paste your site address and we run the whole list from the outside — leaked keys, open databases, unprotected pages — then hand you one prompt that fixes what we find. Free, about 30 seconds, no signup.
Check my site — free