critical severity · fix guide
How to Fix an Exposed API Key
A value shaped like a private key or password is in code your site serves, where anyone can read it. If it still works, anyone who copies it can act as you: run up bills, read your data, or send email in your name. xlogs did not test it.
Why AI tools cause it
AI coding tools often paste an API key straight into a file to make something work, instead of hiding it in a private environment variable. It runs fine, so nothing warns you.
The goal
The exposed key has been replaced and revoked at the provider, because removing it from the code does not stop it working, and the new value is stored only in a server-side secret or environment variable, never in code or the client bundle.
The steps
- Contain and rotate the exposed key first, because removing it from the code does not stop it working: if you suspect it is being misused, revoke it at the provider now; otherwise create a replacement, put it in the app's server-side secret settings, confirm the app works with it, and then revoke the exposed key promptly
- Remove the literal value from the code and any client-side bundle (the spot the scan shows), so the key is read only from a server-only environment variable
- Make sure the .env file is in .gitignore
- Clear the old value from deployed builds and caches, and from the repository's history where you can; once the key is revoked, a copy left there no longer works
Fix it with your AI coding tool
Pick your tool and paste the instruction. It is written to make the goal above true, and to never print any secret values back to you.
Paste this to Any AI tool:
In my app (the spot the scan shows): a credential-shaped value is publicly served. Please make this true: The exposed key has been replaced and revoked at the provider, because removing it from the code does not stop it working, and the new value is stored only in a server-side secret or environment variable, never in code or the client bundle. Steps: Contain and rotate the exposed key first, because removing it from the code does not stop it working: if you suspect it is being misused, revoke it at the provider now; otherwise create a replacement, put it in the app's server-side secret settings, confirm the app works with it, and then revoke the exposed key promptly; Remove the literal value from the code and any client-side bundle (the spot the scan shows), so the key is read only from a server-only environment variable; Make sure the .env file is in .gitignore; Clear the old value from deployed builds and caches, and from the repository's history where you can; once the key is revoked, a copy left there no longer works. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Paste this to Lovable:
In my Lovable app (the spot the scan shows): a credential-shaped value is publicly served. Please make this true: The exposed key has been replaced and revoked at the provider, because removing it from the code does not stop it working, and the new value is stored only in a server-side secret or environment variable, never in code or the client bundle. Steps: Contain and rotate the exposed key first, because removing it from the code does not stop it working: if you suspect it is being misused, revoke it at the provider now; otherwise create a replacement, put it in the app's server-side secret settings, confirm the app works with it, and then revoke the exposed key promptly; Remove the literal value from the code and any client-side bundle (the spot the scan shows), so the key is read only from a server-only environment variable; Make sure the .env file is in .gitignore; Clear the old value from deployed builds and caches, and from the repository's history where you can; once the key is revoked, a copy left there no longer works. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Paste this to Cursor:
In my codebase (the spot the scan shows): a credential-shaped value is publicly served. Please make this true: The exposed key has been replaced and revoked at the provider, because removing it from the code does not stop it working, and the new value is stored only in a server-side secret or environment variable, never in code or the client bundle. Steps: Contain and rotate the exposed key first, because removing it from the code does not stop it working: if you suspect it is being misused, revoke it at the provider now; otherwise create a replacement, put it in the app's server-side secret settings, confirm the app works with it, and then revoke the exposed key promptly; Remove the literal value from the code and any client-side bundle (the spot the scan shows), so the key is read only from a server-only environment variable; Make sure the .env file is in .gitignore; Clear the old value from deployed builds and caches, and from the repository's history where you can; once the key is revoked, a copy left there no longer works. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Paste this to Claude Code:
In my codebase (the spot the scan shows): a credential-shaped value is publicly served. Please make this true: The exposed key has been replaced and revoked at the provider, because removing it from the code does not stop it working, and the new value is stored only in a server-side secret or environment variable, never in code or the client bundle. Steps: Contain and rotate the exposed key first, because removing it from the code does not stop it working: if you suspect it is being misused, revoke it at the provider now; otherwise create a replacement, put it in the app's server-side secret settings, confirm the app works with it, and then revoke the exposed key promptly; Remove the literal value from the code and any client-side bundle (the spot the scan shows), so the key is read only from a server-only environment variable; Make sure the .env file is in .gitignore; Clear the old value from deployed builds and caches, and from the repository's history where you can; once the key is revoked, a copy left there no longer works. Then tell me exactly what you changed, and do not print any secret values back to me or write one into a commit message, a pull request description or a log.
Paste this to Do it myself:
Goal: The exposed key has been replaced and revoked at the provider, because removing it from the code does not stop it working, and the new value is stored only in a server-side secret or environment variable, never in code or the client bundle. Steps: Contain and rotate the exposed key first, because removing it from the code does not stop it working: if you suspect it is being misused, revoke it at the provider now; otherwise create a replacement, put it in the app's server-side secret settings, confirm the app works with it, and then revoke the exposed key promptly; Remove the literal value from the code and any client-side bundle (the spot the scan shows), so the key is read only from a server-only environment variable; Make sure the .env file is in .gitignore; Clear the old value from deployed builds and caches, and from the repository's history where you can; once the key is revoked, a copy left there no longer works.
Then verify it worked
After you deploy the fix, xlogs re-scans your live app and reports whether the key is still found in what it reads. That cannot show the old key was revoked, so revoke it at the provider either way.
Check your app for this issue
Free, read-only. See whether the issue is detected, then rescan after your fix: the recheck says whether it is still detected.