OpenAI API key exposed in your frontend? Do this now

Step 1: revoke the key

OpenAI: platform.openai.com → API keys → delete the key. Anthropic: console.anthropic.com → API keys → disable it. Then create a new key and set a monthly spend limit.

Step 2: move the call to a server

Your frontend should call your own endpoint, and only the server talks to OpenAI. In Next.js that is a route handler:

// app/api/chat/route.ts
export async function POST(req: Request) {
  const { message } = await req.json();
  const r = await fetch("https://api.openai.com/v1/chat/completions", {
    method: "POST",
    headers: {
      Authorization: `Bearer ${process.env.OPENAI_API_KEY}`,
      "Content-Type": "application/json",
    },
    body: JSON.stringify({ model: "gpt-4o-mini", messages: [{ role: "user", content: message }] }),
  });
  return Response.json(await r.json());
}

Step 3: make sure it's really gone

Don't prefix the variable with NEXT_PUBLIC_ or VITE_, check that the old key isn't in your Git history, and redeploy. Then scan the live site again to confirm.