Security guides

What do I do if an API key is in my code?

Replace the key first. Deleting it from your code isn't enough, because it stays in your Git history and may already have been copied. Create a new key, turn off the old one, then keep secrets out of the code.

Do this now

1. Create a new key and turn off the old one at the provider.
2. Check the provider's logs and bill for use you don't recognize.
3. Move the key to an environment variable or a secrets manager.
4. Add .env to .gitignore, and commit only a .env.example with no real values.
5. Scan your history with a tool such as gitleaks --redact so values aren't printed.
6. Add a pre-commit check so it doesn't happen again.

Is a key in frontend code private?

No. Anything sent to the browser can be read by anyone. Keep private keys on your server and call the provider from there.