Keep your .env file away from AI agents
After an update, Cursor's agent edited .env files it hadn't touched before, so the builder treated the keys as exposed and rotated them.
Leaked secrets & API keys
Keys in front-end code or public repos get found and abused within hours. Keep secret keys server-side, set spend limits and turn on secret scanning.
6 items · 1 stories · 5 security incidents
Protect your Anthropic API key from theft
The builder behind PurePath says someone got hold of their Anthropic API key and ran up roughly $500 of model usage. A follow-up post says support called the credits non-refundable.
Set spend limits on every AI API key
A solo builder reports that someone got their API key and ran up their AI bill, but the damage stopped at the spending limit they had set.
Turn on GitHub secret scanning before launch
GitHub secret scanning added detection for Lovable API keys and Supabase tokens; leaked Lovable keys in public repos are reported to Lovable for revocation.
Vet key-proxy services before trusting them
An iOS developer says their OpenAI key leaked three times while using a third-party key proxy, and that usage limits kept the losses small. They no longer recommend that service.
Restrict and cap a Gemini API key
A developer reported a stolen Google Cloud API key that generated about $82,000 of Gemini charges in two days, against a normal monthly spend of about $180.