Check · Leaked API key

Your app runs. Is your OpenAI key in the browser?

The chat feature works, so you shipped it. But if the key that pays for every request sits in a client-side fetch, anyone with DevTools can copy it in ten seconds and bill it to you. Vibe-coded apps leak keys in three places, and none of them show up as an error.