SEV-1: blocks launch

Your AI key runs in the browser

What goes wrong

A stranger copies your key from the network tab and spends your credit on their own project.

Remove dangerouslyAllowBrowser. Create a server route that holds the key, checks who is asking, and calls the AI provider for the browser.

npx sigship

Run it in your project. It reports this check as ai-key-in-browser, along with 16 others. Nothing leaves your machine.