Checks · SEC-005

SEC-005 · AI provider key used from browser

Why it matters

An AI key in browser code can be copied and used to spend on your account.

How we detect it

Client code imports an AI SDK or calls an AI API with a key.

How we fix it

Proxy the call through a server route that requires a signed-in user and a limit.

Can it be fixed automatically? With review

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-004 · Public env prefix on a secret