A credential in your browser bundle

You ask your AI tool to call an API. The quickest thing that works is calling it from the frontend, so the key goes into a browser-visible variable. The app works, nothing warns you, and the key ships to every visitor.

This is the single most common serious flaw in AI-built apps, and it is not carelessness — it is what "make it work" produces.

Revoke the exposed key first. Moving it server-side does not un-publish it: it was in a file anyone could download, and public bundles are scraped continuously by automated collectors.

Treat every credential we report as already collected, whatever your traffic numbers say.

The browser calls your endpoint; your endpoint calls the third party. The key lives in a server-only environment variable, and the browser never sees it.

Add rate limiting to that endpoint. Otherwise you have replaced a stolen key with an open proxy to the same API, billed to you either way.