Find security flaws
before hackers do

// ❌ This goes into your JS bundle. Anyone can open DevTools and read it.
NEXT_PUBLIC_OPENAI_API_KEY=sk-proj-...
NEXT_PUBLIC_STRIPE_SECRET_KEY=sk_live_...

// ✅ No prefix = server-only. Call it from an /api/ route instead.
OPENAI_API_KEY=sk-proj-...

// ❌ This component renders in the browser. sk-... is visible in the bundle.
const res = await fetch("https://api.openai.com/v1/chat/completions", {
  headers: { Authorization: `Bearer ${process.env.NEXT_PUBLIC_OPENAI_KEY}` }
});

// ✅ Make the call in /app/api/chat/route.ts — key never leaves the server.

# ❌ .env was committed on day 1. It's in git history permanently.
git log --all -p | grep "sk_live_"  # attackers run this first

# ✅ Add .env to .gitignore BEFORE your first commit.
# If it was already committed: rotate all keys, then use BFG to rewrite history.

// ❌ service_role key bypasses ALL Row Level Security. Never use in browser.
const supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_SERVICE_KEY)

// ✅ Use the anon key in the browser. Use service_role only in server routes.
const supabase = createClient(url, process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY)

// ❌ This is a client component. The whole OpenAI SDK ships to the browser.
import OpenAI from "openai"  // ← Node SDK, not meant for browsers
const client = new OpenAI({ apiKey: process.env.NEXT_PUBLIC_OPENAI_KEY })

// Your sk-proj-... is now in _next/static/chunks/app/page-[hash].js
// Any visitor: DevTools → Sources → search "sk-" → found.

// ✅ Move to /app/api/generate/route.ts (server-only)
// import OpenAI only there. Client calls fetch("/api/generate") instead.

// ❌ Hardcoded to 'test quickly' — shipped to prod, committed to git.
const genAI = new GoogleGenerativeAI("AIzaSy...")
const stripe = new Stripe("sk_live_51...")

// Now it's in: git history, your JS bundle, and GitHub's public search index.
// GitHub's search finds exposed keys in seconds. So do bots.

// ✅ Always start with .env, even on day 1 of prototyping.
const genAI = new GoogleGenerativeAI(process.env.GEMINI_API_KEY!)