Built an App With AI? Your API Key May Still Be Exposed

AI tools build apps fast, but they often leave your secrets (API keys, passwords and tokens) sitting in your code. Deleting a key doesn't remove it: it stays in your git history, where anyone with access to your code can find it. In this video I show two searches to check your own app, and what to do if you find a key. THE COMMAND Run this in your project folder to search your git history for keys: git log -p --all | grep -E "^\+" | grep -E "sk-|AIza" Change sk-|AIza to match how your own keys start. Those two cover OpenAI-style and Google keys. On Windows, run it in Git Bash, which is installed with Git. WHEN TO RUN IT Before you take money for your app Before you share your code or make it public Any time you've deleted a key from your code IF YOU FIND A REAL KEY 1. Rotate it: go to the service, create a new key, and delete the old one there. 2. Keep the new key in a .env file, and add .env to your .gitignore. 3. Check your usage on the service for requests or charges you don't recognize. THE FULL CHECKLIST This is one check of 20 in my guide, Don't Get Hacked: The Pre-Launch Security Checklist: https://stan.store/andikany/p/launch-... ABOUT ME I'm Andika, a software engineer with four years in cybersecurity and finance. LinkedIn:   / andika-yudhatrisna-97172a229   Instagram:   / andikany   SOURCES (Uber, 2016) https://www.courthousenews.com/former... https://www.techtarget.com/searchsecu... https://www.techradar.com/news/uber-c... https://securityaffairs.com/76587/sec...