Keep secrets out of AI-written code

AI examples often place a key directly in the code because that is the shortest way to show something working. If that code reaches a website or a public repository, anyone can copy the key and use it.

// Never do this in code that reaches a browser
const key = "sk_live_example_do_not_use";

// The server reads it from its private settings instead
const key = process.env.PAYMENT_KEY;

Anything sent to a browser can be read by the person using that browser. A real key must stay on the server, and the browser should ask the server to do the work.

If a key leaks

• Treat it as stolen, even if you removed it quickly.
• Replace it with a new key at once, and turn the old one off.
• Tell your senior straight away.
• Check the account for any use you do not recognise.

🔬 Try it: a key in a website →