Deleted your API key? It still works. Revoke it first

# Monday: the key goes in
git commit -m "add chat"          # app/chat.ts holds sk-proj-...

# Tuesday: you delete the line
git commit -m "remove key"        # app/chat.ts is clean now

# Anyone with a copy of the repo, any day after:
git show HEAD~1:app/chat.ts       # the key is right there

git show prints a file as it was in any old commit. Anyone who cloned or forked the repo can run it.

.env
.env.*
!.env.example

Commit a .env.example with the variable names and no values, so others know what to set.

# .gitignore only stops NEW files. If .env is already tracked:
git rm --cached .env
git commit -m "Stop tracking .env"
# Your local .env stays on disk. The old commits still hold the old key,
# which is why you revoke it first.

import OpenAI from 'openai';

// Runs on the server only. The browser never sees the key.
const openai = new OpenAI({ apiKey: process.env.OPENAI_API_KEY });

export async function POST(req: Request) {
  const { message } = await req.json();
  const res = await openai.chat.completions.create({
    model: 'gpt-4o-mini',
    messages: [{ role: 'user', content: message }],
  });
  return Response.json({ text: res.choices[0].message.content });
}

Add a login check and a rate limit before you ship it. Our AI bill guide shows how.

# 1. Did a .env file ever get committed, on any branch?
git log --all --oneline -- .env '.env.*'

# 2. Which commits ever added or removed a known key prefix?
git log --all --oneline -S 'sk_live_'
git log --all --oneline -S 'sk-proj-'

# 3. Every line in history that looks like a key (prints matches: keep the output private)
git log --all -p | grep -oE 'sk-(proj-)?[A-Za-z0-9_-]{20,}|sk_live_[A-Za-z0-9]{10,}|rk_live_[A-Za-z0-9]{10,}|AKIA[0-9A-Z]{16}|ghp_[A-Za-z0-9]{36}|sb_secret_[A-Za-z0-9_-]{10,}' | sort -u | cut -c1-12

The last command cuts each match to 12 characters, enough to tell which key it is. Never paste full keys into a chat, issue or screenshot.