The most expensive mistake in a vibe-coded app is also the easiest to make: a secret key that ends up in the code your visitors’ browsers download. It happens because the AI was asked to “make the Stripe call work”, and the fastest way to make it work is to call the API straight from the page.
The 30-second check
Open your live site, right-click, choose View page source, and search for these: sk_live_ (Stripe), sk- (OpenAI and Anthropic), AKIA (AWS), service_role (Supabase), ghp_ (GitHub) and BEGIN PRIVATE KEY. If any of them appear, treat that key as stolen. Bots crawl new sites looking for exactly these strings.
Public keys are fine. Secret keys are not
Not every key is a problem. Stripe’s pk_live_ key, Supabase’s anonkey and a Firebase config are designed to be public. They only identify your project; your database rules and server do the protecting. The rule of thumb: if the provider’s dashboard calls it “secret”, “private” or “service”, it must never reach a browser.
Google API keys sit in between. They’re often public on purpose (Maps, Firebase), but an unrestricted one can be used by anyone to run up your bill. Restrict it to your domain in the Google Cloud console.
The fix has three parts, and people skip the second
- Move it. Put the key in a server-only environment variable. In Next.js that means no
NEXT_PUBLIC_prefix; in Vite, noVITE_prefix. Call the API from a server route, and have your page call that route. - Rotate it. Deleting the key from your code doesn’t un-leak it. Generate a new one in the provider’s dashboard and revoke the old one. This is the step that actually protects you.
- Check your history. If the key was ever committed to a public GitHub repo, it’s in the history forever. Rotating covers this too.
Let your AI do the moving
You don’t have to do the refactor by hand. Tell your coding tool exactly what’s wrong and what “fixed” looks like: find every place the key appears, move it server-side, route the call through an API endpoint, and list the files changed. A vibeliq scan finds exposed keys for you, masks them in the report, and writes that prompt so you can paste it straight in.
One limit worth knowing: vibeliq reads your page’s HTML and inline scripts. A key buried inside a separate JavaScript bundle needs the manual search above, using your browser’s DevTools “Search in all files”.