Exposed key
OpenAI key exposed: what to do
Anyone who copies it from your bundle can spend the quota on that key. Browser apps should call your server, and the server should call OpenAI.
How to recognize it
An OpenAI key usually starts with sk-proj- or the older sk- form.
What to do
Revoke the key in the OpenAI dashboard, create a new one, and read it from the server environment only. Rebuild and confirm the new bundle does not contain the prefix.
Paste the public URL of an app you own. The scan reads the page, up to 10 same-origin scripts, and /.env, /.env.local, and /.env.production. It does not search the whole internet, and it does not submit the key to OpenAI to see if it still works.
What does an exposed OpenAI key look like?
An OpenAI key usually starts with sk-proj- or the older sk- form.
Do you store the key if the scan finds one?
No. The report stores a masked fragment and the kind of key. The full value is not written to the database, and the fix prompt does not repeat it.
What should I do with a leaked OpenAI key?
Revoke the key in the OpenAI dashboard, create a new one, and read it from the server environment only. Rebuild and confirm the new bundle does not contain the prefix.
Scan a URL you own
The same free check as the homepage. You confirm the app is yours before it runs.