Why Cursor Ships Your OpenAI Key to Every Visitor (CWE-522)
TL;DR When the OpenAI SDK throws "It looks like you're running in a browser-like environment", AI editors usually fix it by adding dangerouslyAllowBrowser: true and moving the key into a VITE_ or NEXT_PUBLIC_ variable. That ships your secret API key to every visitor. It sits in the JavaScript bundle and in the Authorization header of every request in the Network tab. The fix: delete the flag,…
When trying to use the OpenAI SDK in a browser environment, developers often encounter an error message stating, "It looks like you're running in a browser-like environment." To resolve this issue, they typically add the flag dangerouslyAllowBrowser: true and move the API key into a VITE_ or NEXT_PUBLIC_ variable. This approach inadvertently exposes the secret API key to every visitor, as it ends up in the JavaScript bundle and the Authorization header of each request.
The key is stored in a file that anyone can access, and the browser directly communicates with the provider, sending the key via the Authorization: Bearer header in every request. This situation can be easily exploited by anyone who opens the browser's Developer Tools, making it a significant security concern. Developers often resort to this fix because AI editors optimize for removing the error message, which contains the suggested solution.
Furthermore, OpenAI's SDK refuses to run in a browser by default, explains why, and provides the dangerouslyAllowBrowser flag as the resolution. The same issue exists in the Anthropic TypeScript SDK. Once the client is moved to the browser, the browser calls the provider directly, meaning the key is sent with every request. The only way to mitigate this risk is by removing the dangerouslyAllowBrowser flag, rotating the exposed key, and moving the model calls to a server route that checks the session, implements rate limiting, and caps token usage.
This solution ensures that the key never reaches the user's browser, preventing unauthorized access.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
