Did my vibe-coded app leak an API key?
An API key is leaked when it appears in JavaScript the browser downloads, in a public file such as .env, or in a variable prefixed with NEXT_PUBLIC_ or VITE_.
Which keys are safe in the browser?
A publishable client key, such as a Supabase anon key, is meant to ship in the browser only because server rules limit what it can do.
A service-role key, a secret API key, or a private token is not safe in the browser, because it acts as your server.
Why do generated apps leak server keys?
A generator can paste a secret into a client component, or into a NEXT_PUBLIC_ or VITE_ variable, so the browser calls the provider directly.
That file is downloaded by every visitor who opens the app.
Where else do keys show up?
Keys also show up in a .env file left on the host, in git metadata, in a source map, and on a debug route that prints the environment.
Those URLs do not need the app UI to be opened.
What should I do after a key is exposed?
Rotate the key in the provider dashboard first, because deleting the file does not invalidate a key someone already copied.
Then remove it from the client and from the deploy artifact, store the new value in a server-only variable, and call the provider from a server route that returns only the data the page needs.
How does VibeCheck report a leaked key?
VibeCheck reports the file or URL where the credential appeared and redacts the secret in the report.
The free teaser can show that an issue exists. The paid report includes the redacted evidence and the fix steps.