API key exposure occurs when secret credentials are hardcoded in frontend code, making them accessible to anyone who views your application's JavaScript.
Scan for This VulnerabilityWhen developers hardcode API keys directly in source files, those keys become visible to anyone who inspects the frontend code. Attackers use automated tools to scan websites and GitHub repositories for exposed keys, which they can then use to access your services, rack up charges, or steal data.
Unauthorized API usage and charges (OpenAI, Stripe, AWS)
Access to third-party services under your account
Data theft through compromised database connections
Service disruption if keys are revoked
Financial liability for unauthorized usage
Store all API keys in .env files and access via process.env.
// BAD - hardcoded
const openai = new OpenAI({ apiKey: "sk-proj-abc123..." });
// GOOD - environment variable
const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });Never commit environment files to version control.
# .gitignore
.env
.env.local
.env.productionSecrets should only be used in server-side code (API routes, Edge Functions).
// pages/api/generate.ts (Next.js API route)
export default async function handler(req, res) {
const openai = new OpenAI({
apiKey: process.env.OPENAI_API_KEY // Server-side only
});
// ...
}If a key was exposed, generate a new one and revoke the old key.
VAS automatically scans for api key exposure and provides detailed remediation guidance.
Run Security Scan