API keys are secrets — they should never leave the server environment they are provisioned for. In practice, they end up in git commits (the most common vector), build logs, environment variable dumps, Slack messages, bug reports, and client-side JavaScript bundles. The Uber breach in 2022, the CircleCI breach in 2023, and hundreds of smaller incidents share the same initial access pattern: a leaked API key.
How Keys Actually Get Leaked
Git commits
A developer hardcodes a key for local testing, forgets to remove it, and commits. Even if the commit is later removed or rewritten, GitHub and GitLab search indexes may have cached it. GitHub Secret Scanning catches known key formats — but only if the repository is public or if Secret Scanning is explicitly enabled on private repos.
Build and CI logs
Build pipelines often log environment variables for debugging. If a secret is set as an environment variable and the pipeline logs env output, the key appears in build logs — which may be readable by anyone with repository access, or even publicly accessible for open-source projects.
Client-side bundling
A server-side API key included in a Next.js or Vite bundle ends up in the JavaScript sent to every browser. The key is not visible in the UI but is trivially extractable from the bundle. This is a particularly common mistake with AI API keys (OpenAI, Anthropic) used in frontend code.
The Response Playbook
- 1.Rotate the key immediately — assume it has been discovered and is being actively used
- 2.Search your logs for requests using the leaked key — establish whether it has been used by anyone other than you
- 3.Scope future keys — generate new keys with the minimum permissions required for each use case
- 4.Implement pre-commit hooks (git-secrets, detect-secrets) to prevent future commits containing key patterns
- 5.Enable audit logging on key usage — every API call made with a key should be attributable
G8KEPR supports key scoping — each API key can be restricted to specific endpoints, methods, IP ranges, and rate limits. A leaked scoped key has limited blast radius compared to a leaked root key. Rotate root keys quarterly and use scoped keys for all production integrations.