Search
10 results for "leaked key"
- Leaked Stripe secret key: what to do in the next 10 minutes
Your Stripe secret (sk_) or restricted (rk_) key ended up in your app's JavaScript, a public .env file or GitHub. Rotate it in the Dashboard with expiration Now, store the new key server-side, check the key's request logs and roll a leaked webhook secret, using Stripe's own steps.
- Leaked OpenAI API key: what to do in the next 10 minutes
Your OpenAI API key ended up in your app's JavaScript, a public .env file or GitHub. Delete it on the API keys page, create a new server-only key, check Usage, set a hard spend limit and tell OpenAI Support, using OpenAI's own steps.
- Leaked Supabase service_role or secret key: what to do in the next 10 minutes
Your Supabase sb_secret_ or legacy service_role key ended up in your app's JavaScript, a public .env file or GitHub. It bypasses Row Level Security. Remove it from client code, create a new secret key, switch every server to it, then delete or deactivate the old one, using Supabase's own steps.
- Leaked AWS access key: what to do in the next 10 minutes
Your AWS access key (AKIA...) and secret ended up in your app's JavaScript, a public .env file or GitHub. Deactivate it in IAM, replace it, check CloudTrail for new users, keys, roles and instances in every Region, and don't remove AWS's quarantine policy, using AWS's own steps.
- I leaked an API key in my vibe-coded app. What do I do now?
A calm, step-by-step plan for when a Supabase service_role, OpenAI, Stripe or other secret key ends up in your Lovable, Bolt or Cursor app's JavaScript, a public .env file or GitHub: rotate first, check usage, move it server-side, then re-check your live site.
- Leaked a key?
What to do in the next 10 minutes: OpenAI, Stripe, Supabase, AWS, GitHub.
- Safe-prompt pack: free security rules to paste into Lovable, Bolt, Cursor, Claude Code and Rork before you build
Copy-paste 'before you build' security rules for your AI builder: Lovable Knowledge, Bolt Knowledge, a Cursor .mdc rule, CLAUDE.md / AGENTS.md and Rork / Expo. They steer the AI away from leaked keys, open tables and missing server checks. Then scan your live app to see what actually shipped.
- Supabase security scanner: which free tools check what (inside vs outside)
Looking for a Supabase security scanner? Compare the free options by what they can see: Security Advisor inside your database, migration linters and database tests before you deploy, and outside scans of your live site for leaked keys and tables strangers can read.
- Vibe-coded app security checklist: 14 checks before you launch
To check if your vibe-coded app is secure, test your live site, your database and your code. This checklist for Lovable, Bolt, Cursor, Replit and v0 apps covers leaked keys, Supabase RLS, storage buckets, API route auth, rate limits, webhook signatures and headers, with a test for each.
- Free Supabase exposed data checker
Check what your live Supabase app shows strangers: leaked service_role or sb_secret_ keys, public .env files, and which tables an anonymous visitor can read with your public key.