A single leaked API key has cost solo developers thousands of dollars overnight.
Here's why: an API key is your house key for a service. Anyone holding it can use your account — OpenAI, Stripe, AWS, Google Maps. Lose one, and someone else runs up your bill.
Losing one is shockingly easy. Bots scan public GitHub repos 24/7. The moment a key hits a public repo, automated scrapers find it within seconds. AI coding tools might even make this worse. They generate code with example keys filled in, and sometimes, vibecoders push it before reviewing.
Where keys should live:
In a .env file at the root of your project, like:
OPENAI_API_KEY=sk-abc123…
STRIPE_SECRET=sk_live_xyz…
Then add .env to your .gitignore (so Git skips it). Your code reads them at runtime. They never enter your repo.
Already pushed something? Audit with: GitHub Secret Scanning (auto-enabled on public repos), Trufflehog (open-source scanner), or Git-secrets (blocks them at commit time). If a key was exposed, rotate it as deleting the commit isn't enough.
Follow
@foundingdev for more.
#vbecoderbasics