Security Tip: Your API Keys Are Probably Sitting in Your Code in Plain Text

Somewhere in your website's code there is a key, a password, or a database connection string typed in plain text — and if that code ever reaches a public repository, a shared snippet, or a backup folder, that secret is public too. It does not matter that the key was only meant for your server. Once it is written into the code itself, anyone who can read the code can use the key.

This is not a rare mistake. GitGuardian's State of Secrets Sprawl report counted 28,649,024 new secrets exposed in public GitHub commits in 2025 — a 34% rise on the year before. Around 6% of public repositories contain at least one hardcoded secret, and 64% of the secrets confirmed valid in 2022 were still unrevoked in 2026. Bots scan public code within minutes of a push, and a key that still works is a key that still gets used.

AI-assisted coding made it worse. Commits written with AI tools leaked secrets at roughly twice the GitHub-wide rate, and leaks of AI-service credentials grew 81% in a year to over 1.27 million. The assistant writes working code fast, the developer pastes it in, and the API key that made the example run stays in the file. Convenience in the draft becomes a credential in production.

The fix is boring on purpose. Keep every secret out of the code: environment variables on the server, a secrets manager for anything shared, and separate keys for development and production, so a leaked test key cannot touch live data. Scan the repository before every push — GitHub's own secret scanning and free tools catch the common formats — and treat a leaked key as already compromised: revoke it, rotate it, and check the logs for use.

If you have never checked, check today: search your code for "api_key", "password", "secret" and "token" and see what comes back. Whatever you find does not belong there.

A free scan at https://vulnerabilitytools.com/ shows you what your site is exposed to right now — then move the secrets out of the code, rotate what leaked, and scan again before the next push.