Vibe Coding Is Quietly Shipping Your API Keys to GitHub
You asked the AI to "just get Stripe webhooks working." Thirty seconds later it did. The code ran, the test payment went through, and you pushed. What you may not have noticed is line 14: const secret = " sk_live_51Hx...9Qa " ; That is a live Stripe key, now sitting in your Git history. Deleting the line in the next commit does not remove it. Anyone who clones the repo — or any bot scanning…
AI coding assistants are inadvertently leaking API keys to GitHub by pasting them inline during debugging or copying example configurations into the code. AI-generated diffs often contain hard-coded strings that go unnoticed until a pull request is merged. Leaked keys can be abused within minutes by automated scrapers watching for new commits that match key formats.
The fix involves rotating the key and cleaning up the history if the repository is public. To prevent leaks, keep secrets out of the code entirely, block secrets before committing using tools like Gitleaks or detect-secrets, and automatically review every pull request for secrets. A new AI code review tool called Diffnix can flag hard-coded secrets and suggest moving them to environment variables in under five seconds, helping to catch secrets before they are merged into the codebase.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
