Tutorialby

A key exposed
in your code.

Revoke first, clean up second.

Our intake check found a key in your code, or a provider warned you. Deleting it is not enough: GitHub keeps the history. There is one thing your AI will handle very well, and one only you can do. We start with that one.

Revoke the key at the provider, let the AI take it out of the code, check the history.

Five steps.

01
At the key's provider (OpenAI, Stripe, Supabase...), revoke it. From then on it is worthless, wherever it may be lying around. Create a new one in the same place.
02
The code is your AI's job: paste it what your space wrote to you and ask it to take the key out of the code. It removes it, notes its name in .env.example, and commits.
03
Push, as usual. On GitHub, the file is clean.
04
Look at the history: the old version is still there, with the key. That is why we revoked it first.
05
The new key lives in your platform's Secrets, or in .env on your machine. Never in the code. Then, in your space, sign the authorization again: the audit resumes.

Word for word.

What the video says, to read at your own pace or find one word again.

Read the full transcript

Your space stopped you: our intake check found a key in your code, and it tells you where. Two things to do. One your AI will handle very well, and one only you can do. We start with that one.

The key is right there, hard-coded, and GitHub kept it.

At the provider, we revoke it. From now on, it is worthless, wherever it may be lying around. You will create a new one in the same place, right after. This is the only step that protects you, and it takes thirty seconds.

Now the code. Not by hand: that is your AI's job. Paste it what your space wrote to you, and ask it to take the key out of the code. It removes it, notes its name in .env.example, and commits.

You push, as usual.

On GitHub, the file is clean. But look at the history: the old version is still there, with the key. Deleting is never enough. That is why we revoked it first.

The new key lives in your platform's Secrets, or in .env on your machine. Never in the code. Then, in your space, sign the authorization again: the audit resumes.