Lovable: how API keys end up in your frontend

Ask Lovable to summarise text with AI and it will write the OpenAI call. The natural place to put that call, in a frontend-first tool, is the frontend. Which means the key travels to every visitor.

Which keys are actually a problem

This trips people up, so be precise. Some keys are public by design and finding one in your bundle means nothing:

• Supabase anon key — public by design. Safe only if RLS is on.
• Firebase apiKey — public by design. It identifies the project, it does not grant access. Your Firestore rules do that.
• Stripe publishable key (pk_live_…) — public by design.

And some are a genuine emergency the moment they reach a browser:

• OpenAI (sk-…), Anthropic (sk-ant-…) — anyone can spend your credit until the card declines.
• Stripe secret key (sk_live_…) — moves real money and reads every customer record.
• Supabase service_role key — bypasses every RLS policy you have. Total database access.
• AWS access keys (AKIA…) — the single most-scanned secret on the internet.

Check your own bundle in two minutes

Fix it

Any call needing a real secret has to happen server-side. In Lovable that means a Supabase Edge Function: the browser calls your function, the function holds the key and calls the provider. The key never leaves the server.

Find every API key in my project and move the secret ones server-side.

1. Search all client code for hardcoded credentials: strings starting with
   sk-, sk_live_, AKIA, ghp_, or any variable named *_SECRET, *_API_KEY,
   *_TOKEN.
2. For each one, tell me whether it is public-by-design (Supabase anon key,
   Firebase apiKey, Stripe publishable key) or a real secret.
3. For every real secret: create a Supabase Edge Function that makes the
   provider call, read the key there from an environment variable, and
   change the frontend to call my Edge Function instead of the provider.
4. Remove the key from all client code and from any VITE_-prefixed variable
   — anything with that prefix is compiled into the browser bundle.

List every key you found, where it was, and what you did with it. I will
rotate each one afterwards.