A secret key is written into the code

The key for a paid service, like OpenAI or Anthropic, is pasted straight into the source code as a string.

Source code gets copied everywhere. It goes to GitHub, into screenshots, into chat logs, into the JavaScript bundle your users download. Once a key is in a commit, deleting the line does not remove it. It stays in the git history.

Bots scan public GitHub for key shapes like sk- within minutes of a push. They do not need to understand your app. They only need the string.

Your chat app works. You push it to a public repo so a friend can try it.

const client = new OpenAI({
  apiKey: "sk-proj-...",
});

1. A scraper watching new public commits matches the sk-proj- pattern in your file.
2. It tests the key with one cheap API call. The call works.
3. The key is sold or used directly to run large batches of requests on your account.
4. You find out from the bill, or when the provider suspends the key for abuse.

The cost: Direct money loss, plus anything else that key can reach: your stored files, fine-tuned models, or usage history.

Paste this into Claude Code, Cursor, or whatever wrote the code. When llm-audit finds the mistake in your project, npx llm-audit prompt gives you the same prompt with every file and line filled in.

Fix this in my project: an API key is written directly in the source code.

Please:
1. Remove the key from the code. Read it from a server-side environment variable instead, for example process.env.OPENAI_API_KEY.
2. Make the app fail at startup with a clear message if that variable is missing.
3. Make sure this code only runs on the server. The variable must not start with NEXT_PUBLIC_ or VITE_.
4. Do not print the key in any log or error message.

Show me the diff. Then remind me to revoke the old key in the provider's dashboard, because it is still in my git history.

A prompt that looks for the same mistake everywhere else, without changing anything yet.

Check this project for secrets written into the code before I ship it.

Look for:
- API keys, tokens, and passwords as string literals (sk-, sk-ant-, sk_live_, ghp_, AKIA, xoxb-, private key blocks).
- Fields or variables named like secret, token, password, apiKey, or serviceRole set to a fixed string.
- Environment variables starting with NEXT_PUBLIC_ or VITE_ that hold anything secret, since those ship to the browser.
- .env files that are committed to git.

For each one, give me the file and line, say which service the key is for, and explain in one sentence what someone could do with it. Do not change any code yet.