What to do if your OpenAI, Anthropic or other AI key leaked

Why leaked AI keys get used fast

Anyone holding your API key can make requests that are billed to you. People run automated searches of public GitHub repos and website code looking for keys, so a key that's public for even a short time may already have been copied.

Deleting the file or the commit doesn't help on its own. The key is still in your git history, in forks, and in any copy someone already made.

What to do right now

Work through these in order:

• Revoke the key in your provider's dashboard (OpenAI, Anthropic, Google Gemini, Stripe or whoever issued it). Revoking is the only step that actually stops someone who has a copy.
• Create a new key and put it in an environment variable on your server or host, not in your code.
• Check the provider's usage page for spending you don't recognise, and contact their support if you find any.
• Set a monthly spend limit or budget alert on the account, so a future leak can't cost more than you can afford.
• Search the rest of your code and repo for other keys that may have leaked the same way.

Where keys usually leak

• Front-end code. Anything your website sends to the browser is public, including keys in JavaScript bundles. Calls to AI providers belong on your server.
• Committed .env files, or config files for agents and MCP clients with tokens typed straight in.
• Example code, notebooks and test files that were pushed with a real key still in them.
• Screenshots and screen recordings of a terminal or dashboard.

Check your site and repo

Our free scan looks through your site's code and your public GitHub repo for keys from Anthropic, OpenAI, Gemini, Stripe and others. Any key it finds is masked before it's saved, so we never store the full key.