Back to overview
Risk
API key right in the code
Keys belong in environment variables – not in the middle of your code.
When prototyping fast, it's tempting to just paste the API key straight into the code. It works instantly – and that's exactly what makes it vulnerable.
What happens
The key sits as plain text in a .ts, .js or .py file. Anyone who opens that file sees it – in a public repo, a shared screenshot or a pull request.
Why it's dangerous
Code gets copied, shared and versioned. Once the key is in there, it travels along. Whoever finds it can spend money on your account or pull data – without you noticing.
How Env Clinic helps
Env Clinic scans your source code locally for exactly these keys and shows you the file and line – with the value redacted.
env-clinic scan .
- Finds keys in source files
- Tells you whether to rotate the key
- Explains where the key belongs instead