Guide · 2 min read · Updated
Leaked an API key? What to do in the next 10 minutes
It happens to everyone. A key ended up in your code, on GitHub or in your website. Here's what to do, in order.
1. Replace the key, right now
Go to the dashboard of the service (OpenAI, Anthropic, Stripe, Resend and so on). Create a new key, then delete or disable the old one. Deleting the key from your code is not enough: copies may already exist, and git keeps old versions.
2. Check for damage
Look at the service's usage and billing page for spending you don't recognise. Set a spending limit if the service offers one. If you see abuse, contact the service's support.
3. Put the new key somewhere safe
Store it as an environment variable in your host's settings (Vercel, Netlify, Supabase, Replit Secrets and similar), and only use it in server code. Never give it a public prefix like NEXT_PUBLIC_ or VITE_. Why.
4. Clean up the code
Remove the key from your code and make sure your .env file is on the .gitignore list. How.
5. Make sure it's the only one
Run npx sigship in your project. It looks for keys in your code, committed .env files and secrets with public names, and tells you where they are without printing them.
Questions
Does GitHub tell me if I leak a key?
GitHub's secret scanning catches many known key formats in public repositories and may alert you or the provider. Don't rely on it: replace the key yourself as soon as you know.
Can I just make the repository private?
It helps going forward, but anyone who saw or copied the key while it was public still has it. Replace the key first.