Fix · Problems with AI tools

The AI put my key or password directly in the code

UrgentSecurity

What you may see

I see a long key text inside a file the AI wrote
The AI asked me to paste my API key into a file

Most likely cause

When it is told "use my key", a tool may write it into the code, from where it can leak to GitHub and to every visitor.

Check first (about two minutes)

Search the project for the first characters of the key (if it was never pushed, you are safe to continue the fix).
Was the file ever pushed or deployed?

The fix prompt

What you type here never leaves your browser. The search runs on this page, and nothing is sent to a server or to an AI.

The exact error or what you see

What you did before it happened

Kept only in this browser, on this device. Keys and passwords are removed before anything is saved.

Prompt language

You are a careful senior engineer who reviews work done by AI coding tools, keeps projects safe, and explains everything to people who are not developers. I am not a developer, so explain every step in plain words and tell me exactly which button, menu or command you mean. If you are not sure about something, say so; do not guess.

This is urgent. Do the safety steps first, before anything else.

THE PROBLEM
The AI put my key or password directly in the code

THE EXACT ERROR OR WHAT I SEE
[paste the exact error here]

WHAT I DID BEFORE IT HAPPENED
[write in a few words what you did before it happened]

MOST LIKELY CAUSE
When it is told "use my key", a tool may write it into the code, from where it can leak to GitHub and to every visitor.

DO THESE STEPS, IN THIS ORDER
1. Find every secret-looking value in the code (keys, tokens, passwords, connection strings) and list them by file and line, without printing the values.
2. Move each into an environment variable read by server code, add a sample file with names only, and make sure the real file is ignored by Git.
3. If any of them was ever pushed or deployed, tell me to rotate that key now (see the entry for a key in GitHub).
4. Add a check (a script or hook) that fails when a secret-looking text is staged for commit.
Stop and tell me if what you see does not match a step. Do not skip ahead.

CHECK THAT IT WORKED
- A search finds no secret in tracked files, the app works from environment variables, and old keys are replaced if they were exposed.
Tell me exactly what I should see on the screen when it works.

DO NOT CHANGE
- Do not print or repeat any secret in your answers.
- Anything I did not ask about: the design, the text, other pages, other settings or the data.
- Do not delete files, data or branches, do not reset or force-push, and do not rewrite history, unless you first show me exactly what would be lost and I say yes.
- Do not paste, print or ask me to paste a password or secret key into this chat. If one is needed, tell me which settings page of the right service to store it in.

WHEN YOU FINISH
Explain in simple words what you changed (file by file or setting by setting), why you changed it, and how I can undo it.

Paste it into Claude, ChatGPT, Gemini or Cursor, then follow what it says.

After you tried it, did it work?

Steps

Find every secret-looking value in the code (keys, tokens, passwords, connection strings) and list them by file and line, without printing the values.
Move each into an environment variable read by server code, add a sample file with names only, and make sure the real file is ignored by Git.
If any of them was ever pushed or deployed, tell me to rotate that key now (see the entry for a key in GitHub).
Add a check (a script or hook) that fails when a secret-looking text is staged for commit.

Do not do this

Never type a real key into an AI chat so it "can use it".
Do not print or repeat any secret in your answers.

Try another entry