Leaked keys and secrets in AI-built apps

Roughly one AI-built app in five has its .env secrets file committed to GitHub. Keys written straight into the code are rarer, and keys shipped to the browser rarer still, but each of those is an incident on its own.

15%

had a .env secrets file committed to the repository

3%

had a secret key written in the code

2%

put a secret in a variable that is shipped to the browser (VITE_, NEXT_PUBLIC_)

How keys leak in AI-built apps

Three patterns account for almost every case:

  • The .env file is committed because the project was exported or pushed before a .gitignore existed, or the AI tool created the file and git added everything.
  • A key is pasted into the code "to get it working" and the AI keeps it there in later edits.
  • A secret is given a VITE_ or NEXT_PUBLIC_ name so the front end can reach it, which publishes it to every visitor.

What to do

Treat any key that was ever committed as public: rotate it at the provider first, then remove the file and add .env to .gitignore. Removing it from the latest commit alone does not help; the history keeps it. Keys that only the server should use must never get a public prefix.

Data: Redproof's automated checks on public GitHub repositories, November 2026. No repository is named. Method and limits