An exposed AI provider key
A billing problem before it is a security problem.
What actually happens
Nobody steals your data with an OpenAI key. They spend your credit. Working provider keys are collected and resold, and the usual first sign is a rate-limit error or an invoice that does not match your traffic.
There is no cap unless you set one, which is why this is worth acting on today rather than this week.
Three things, in this order
1. Revoke the key in the provider dashboard.
2. Set a hard monthly spend limit on the account, so the next mistake has a ceiling. Most providers support this and almost nobody switches it on.
3. Move the call to a server route with rate limiting, reading the key from a server-only variable.
The trap in the fix
A server route that proxies to a model with no limits is still an open tap — anyone can call your endpoint instead of your key. Rate limit per IP and per user, and cap the tokens per request. Otherwise you have moved the problem, not solved it.
Not sure whether this applies to you?
Give us the address and we will tell you. No code, no access, no install — and every finding we have is shown in full, including on the free trial.
Check a site