FIX BY SYMPTOM
API key exposed in your app or GitHub repo?
If a secret key is in your front-end code or Git history, assume it is compromised: rotate it at the provider first, then move the call to a server or Edge Function, then check usage and billing for abuse. Deleting it from the latest commit is not enough. Some keys are designed to be public; secret keys never are. VibePitstop removes exposed keys and gives you a rotation checklist as part of an auth & database security fix.
Public by design vs secret
| Key | Safe in the browser? |
|---|---|
| Supabase anon / publishable key | Yes, if RLS protects every table |
Supabase service role / sb_secret_ key | Never. Bypasses all RLS |
Stripe publishable key (pk_) | Yes |
Stripe secret or restricted key (sk_, rk_) | Never |
| Firebase web config | Yes, if Security Rules are correct |
| OpenAI, Anthropic, Resend and similar API keys | Never |
What to do, in order
- Rotate the key at the provider and update it in your host's server-side secrets.
- Move the call into an API route or Edge Function that holds the key, and call that from the browser.
- Check usage and billing for calls you did not make; set spending limits where the provider offers them.
- Prevent repeats: keep
.envin.gitignore, never give a secret aVITE_orNEXT_PUBLIC_prefix, and turn on GitHub secret scanning and push protection.
Want it fixed instead?
Auth & database security fix (Supabase, Firebase): from $400 (one issue); larger scope quoted up to $800 after diagnosis. The $149 diagnosis is credited toward any paid job.
Common worries, answered
- Will you mess up my repo? No. We work from read-only access, and every fix arrives as a pull request. Nothing merges until you merge it.
- Is this just more AI? AI coding agents help prepare fixes. A human reviews every fix before it ships.
- What if it still breaks? We keep working until the written scope is done, at no extra cost. Fixed, or we keep working free until it is (within the written scope).
- What about Stripe and my secret keys? Scoped access only. We never take full keys or owner logins; your secrets stay yours.
- How is this different from asking ChatGPT? We don't stop at advice. We fix and launch against a written scope.
Get a $149 diagnosis See pricing Fix my auth & database security Book the $469 audit
- Fixed, or we keep working free until it is (within the written scope).
- A human reviews every fix before it ships.
- read-only access; fixes arrive as pull requests you merge
- Your $149 diagnosis is credited in full toward any paid job.
FAQ
Is it enough to delete the key from my code?
No. It remains in Git history, old builds and anyone's copy. Rotation is the fix.
My Supabase anon key is visible. Is that a leak?
No, it is meant to be public. The risk is tables without correct RLS. See how to check.
Can you check my whole app for exposed keys?
Yes. The $469 security audit covers exposed keys and secrets in front-end code, the repo and its history, with a written report.