Move API keys off the client bundle — Cursor

Using a different tool? Pick your stack:

The prompt for Cursor

Copy and paste this into your Cursor chat exactly as-is.

Apply these changes to my codebase. Edit the files directly and keep existing formatting:

CRITICAL: Move exposed API keys server-side immediately

1. CRITICAL: API keys are exposed in the frontend. Move all keys to environment variables immediately.
2. Create a server-side API route (app/api/) for each external API call that needs a secret key.
3. Remove any hardcoded secrets from client-side code — only use process.env.* in server components and API routes.
4. Never prefix secret keys with NEXT_PUBLIC_ — that exposes them to the browser.
5. Add .env* to .gitignore immediately.
6. Rotate every leaked key in the provider dashboard — assume they are compromised.

Why this matters

Common mistakes to avoid

• error_outlineUsing `NEXT_PUBLIC_STRIPE_SECRET_KEY` — the prefix made it public. Every `NEXT_PUBLIC_*` ships to the browser.
• error_outlineCalling OpenAI directly from a React component — the key is downloaded with the JS bundle.
• error_outlineCommitting `.env` to git instead of `.env.local` — `.env` is often tracked by default.
• error_outlineUsing the Supabase `service_role` key in a client — it bypasses RLS and reads/writes everything.
• error_outlineShipping a key in an API route but logging `process.env` on error, leaking into logs.

How to verify the fix worked

• check_circleOpen DevTools → Sources → search for the key value — must return 0 matches.
• check_circle`curl https://yoursite.com/ | grep "sk_live"` — returns nothing for Stripe secret keys.
• check_circleRotate the key after exposure — old keys are compromised forever even if "pulled".
• check_circleSet up GitGuardian or git-secrets on the repo to catch future leaks pre-commit.

Frequently asked questions