AI & Infra7 min readUpdated November 7, 2026

How Do API Keys Actually Leak? (It Is Almost Never .env)

Every leaked-key post gets the same advice: put it in .env, gitignore it, done. We went through ten real incidents from this year. Not one leaked through .env.

Keys leak through the places .env hygiene does not cover: application logs, client-side bundles, error trackers, browser extensions, public repos with history, and AI agents that echo secrets into transcripts. The fix is not better storage, it is blast radius: scoped keys, short-lived credentials, spend alerts, and automatic rotation. Assume any key that has ever been logged or bundled is burned.

Going through the leaked-key stories of the past year, bills ranged from $2 to about $87K.

See How We Work

In This Guide

Ten incidents, one pattern

Going through the leaked-key stories of the past year, bills ranged from $2 to about $87K.
Going through the leaked-key stories of the past year, bills ranged from $2 to about $87K. The leak paths: a key in a client bundle shipped to production, keys in application logs indexed by a log search service, a key in an error tracker visible to anyone with the project link, keys in public repos pushed in a moment of haste, and agents or extensions that read more than they should. None of them were .env files. The storage was never the problem. The movement was.

Blast radius beats hygiene

You will eventually leak a key. Design for that: scoped keys so one leak cannot read or spend everything, spend limits so the meter stops, short TTLs so a leaked key expires before it is found, and rotation runbooks so replacing a key is a 10-minute operation, not a weekend. Hygiene reduces the probability.
You will eventually leak a key. Design for that: scoped keys so one leak cannot read or spend everything, spend limits so the meter stops, short TTLs so a leaked key expires before it is found, and rotation runbooks so replacing a key is a 10-minute operation, not a weekend. Hygiene reduces the probability. Blast radius reduces the damage. You need both, but only one of them is certain.

The 30-minute audit

List every key in your secrets manager with its scope and age. Grep logs and error trackers for key prefixes. Check git history of every repo for key-shaped strings, not just HEAD. Confirm spend limits exist on every provider.
List every key in your secrets manager with its scope and age. Grep logs and error trackers for key prefixes. Check git history of every repo for key-shaped strings, not just HEAD. Confirm spend limits exist on every provider. Anything scoped too wide, too old, or visible in a log goes on the rotation list for this week.

4 Tips to Get Started

1

Set a hard spend limit on every AI and cloud API key, not an alert, a limit. The difference between a $2 leak and an $87K leak is usually whether the provider let the meter keep running.

2

Scan your logs and error tracker for key-shaped strings (sk-, AKIA, ghp_, eyJ). Keys end up in logs through debug statements and exception payloads far more often than through commits.

3

Give each integration its own key with minimum scope. One key used by frontend, backend and cron means one leak burns everything.

4

Rotate on a schedule and on suspicion. If a key is older than 90 days and cannot be rotated without an incident, that dependency is the actual finding.

Ready to Stop Worrying About Infra?

Knowledge is the first step. Get a free 1-hour diagnostic and see where your infrastructure leaks time, money, and focus.

Sources & References

roqy.io cites authoritative sources including engineering blogs, vendor documentation, industry surveys, and academic research to ensure accuracy.

Related Guides

Who Owns Vibe-Coded Internal Apps When the Builder Leaves?

Marketing built a dashboard on a personal Vercel account with a service key. The builder left. Who owns it, who fixes it, and how to prevent the next orphaned app.

What Do You Do When Your DevOps Team Shrinks but Your Infrastructure Triples?

Microservices tripled in 8 months, the DevOps team stayed the same size, then got smaller. The realistic options: platform guardrails, deletion, and buying back hours.

Why Do Internal Dashboards Become a Maintenance Nightmare, and How to Fix It?

Tens of internal tools, each breaking when the data model changes. Why internal dashboards rot, which ones to keep, and the pattern that makes the rest maintainable.

Why Do AI-Generated PRs Break Your Infrastructure, and What Guardrails Work?

AI pull requests change pipelines and add services that need config outside the codebase. Why code review cannot catch it, and the four guardrails that do.

R

Ron Cohen — DevOps engineer & founder, roqy.io

Content reviewed by the roqy.io team. Our guides are based on publicly available data and cited sources above.

Disclaimer: This content is for informational and educational purposes only. It does not constitute professional advice or a guarantee of specific results. Infrastructure needs vary by team, stack, and stage. Consult a qualified engineer for advice tailored to your situation.

Frequently Asked Questions

What are the most common ways API keys leak?

In order of frequency in real incidents: application and server logs, client-side JavaScript bundles that shipped the key to the browser, error-tracking services capturing exception payloads, public Git repositories (including deleted commits that stay in history), browser extensions and packages exfiltrating secrets, and AI coding agents that paste secrets into prompts or transcripts.

Is putting secrets in .env files safe?

.env is fine as a local convention. It is not a security boundary. It does nothing for keys that reach logs, bundles, error trackers or a teammate's screenshot. Treat .env as where keys rest, not where they are protected.

How do I detect a leaked key before the bill arrives?

Three layers: provider-side spend limits that hard-stop runaway usage, your own alerting on abnormal API call volume or geographic anomalies, and secret scanning (GitHub push protection, gitleaks in CI) on every repo including private ones. The spend limit is the only one that caps the damage with certainty.

Get the DevOps Ecosystem Behind You

One accountable engineer. Full platform behind him. Month-to-month, no lock-in.

See How It Works