Vibe-Coded Your First App? 6 Security Checks to Do Before You Share It

You just shipped your first app. Maybe it's a tool that summarizes your emails, a little widget that turns photos into cartoons, or a quiz that helps your kid practice spelling. You told the AI what you wanted, the AI wrote the code, you hit "Deploy," and now your creation is out in the world.

That feeling is great. It's also the moment to slow down for half an hour.

AI-built apps — sometimes called vibe-coded apps, because you described the vibe of what you wanted rather than writing each line by hand — have one specific, painful failure mode that catches a lot of first-timers: an API key (think of it as a secret password that lets your app talk to a paid service like OpenAI or Anthropic) gets left directly in the code, the code lives in a public place, and someone finds the key and starts using it. The bill shows up the next morning. It can be hundreds. It can be four figures. It's happened to people who had no idea their project was exposed.

This guide walks through the six checks that close the most common holes. None of them require coding experience. You'll need an account on whichever service your app uses (OpenAI, Anthropic, Google Cloud, and so on), and a few minutes to click through some settings.

A quick note before we start: AI coding tools like Cursor, Bolt, v0, and Replit all work a little differently under the hood. Exact button names vary, but the underlying idea — "keep secrets out of the code itself" — is the same everywhere. If a step doesn't match your tool exactly, the principle still applies.

Step 1 — Find any secret that might be hiding in your code

Open your project's files and search for anything that looks like a key. The most common pattern is a long string of random letters and numbers sitting next to a word like key, token, secret, or api.

In most editors, press Ctrl+F (or Cmd+F on Mac) and search for sk- — that's the prefix OpenAI uses for its keys, and it's the single most common giveaway. Also try api_key, API_KEY, OPENAI_API_KEY, and sk-ant- (Anthropic's prefix).

💬 Example line you might find: openai.api_key = "sk-abc123xyz..."

You'll know it worked when you either see no matches, or you've found at least one match and you're ready to do something about it (which is the next step).

If you find a key: don't panic, and don't paste it into chat to ask if it's "the dangerous kind" — assume any key sitting in your code is exposed, and move to step 2 to rotate it.

Step 2 — Move every secret into an environment variable

An environment variable is a setting that lives outside your code, in a separate file or a dashboard, that your code reads at runtime. Think of it like the difference between writing your house key on your front door (visible to anyone who walks past) and keeping it in your pocket (still accessible to you, but not on display).

In most AI coding tools, this means creating a file called .env in the root of your project and putting your key there:

💬 Example: OPENAI_API_KEY=sk-your-key-here

Then, in your code, you reference the variable by name rather than pasting the actual key. The exact syntax depends on your tool, but the pattern is the same: the code says "look up the key from the environment," not "here is the key."

Most vibe-coding tools also have a way to set these secrets through their interface (look for "Secrets," "Environment," or "Vars" in the sidebar or project settings). If your tool has both options, use the dashboard version — it's harder to accidentally commit to a public place.

You'll know it worked when your code no longer contains the actual key string — only the variable name — and your app still runs the same as before.

Step 3 — Check whether your code is public

AI coding tools often publish your project to a public URL or a public code repository by default. That's how easy "share my work" becomes. It's also how strangers find leaked keys.

Open your project and look for any of these signs:

• A public URL (something like yourname-tool.example.com)
• A GitHub or GitLab repository marked as public
• A "Share" or "Deploy" button that says "Public"

If your project is intentionally public — say, an open-source tool — that's fine, but it makes steps 1 and 2 even more important. If it became public by accident and you didn't mean for that, change the visibility setting now. Most platforms have a "Private" toggle, often under project settings or a "Make private" link.

You'll know it worked when you can explain to a friend how someone could (or couldn't) view your code without your permission.

Step 4 — Set a spending limit on the service you're using

This is the single most important step, and the one most first-time vibe coders skip.

Every major AI service has a billing page where you can set a hard cap on what you'll be charged. If a stolen key gets used to run thousands of expensive requests, you want the service to say "no" after the first few dollars — not at the end of the month.

Look for "Billing" or "Plans" in your account settings, then find a "Usage limit" or "Monthly cap" toggle. The exact path changes per service, but the idea is the same: pick a number you'd be okay losing, set it as a hard limit, and turn on email alerts for unusual activity.

💬 Example prompt to ask your AI tool: "Find where I can set a monthly spending limit on my OpenAI account and walk me through the steps."

You'll know it worked when the limit is visible in your dashboard and you have email alerts set for at least 50% and 90% of the cap.

Step 5 — Rotate any key that was ever in your code

If you found a key in step 1, treat it as compromised — even if your repo was private. People share links, screenshots get taken, and "private" sometimes isn't.

Rotating a key just means generating a new one and deleting the old one. On the service's dashboard, look for "API keys," click "Create new key," copy the new one, and put it in your .env file or secrets dashboard. Then return to the service and delete the old key.

The old key stops working the moment you delete it. Any new charges from before that point are still on your account — which is exactly why step 4 came before step 5. A spending cap is what limits the damage; rotation is what stops it from continuing.

You'll know it worked when the old key returns an "invalid" or "revoked" error if you try to use it, and your app still works using the new key.

Step 6 — Add a basic rate limit to your app

A rate limit is a rule that says "no more than X requests per minute" from a single user. Without one, even a legitimate user with a slow internet connection can accidentally trigger thousands of API calls.

If you used an AI coding tool, the AI probably didn't add a rate limit unless you specifically asked for one. You can fix that with a single prompt — open your project and type something like:

💬 Example prompt: "Add a rate limit so any single user can make at most 20 requests per hour. Return a friendly error message if they go over."

The AI will figure out the right place to add it. Many AI coding tools also have a settings panel where you can set a project-wide rate limit without changing code at all.

You'll know it worked when you try to fire off 30 requests in a row from your own app and the last 10 get blocked with a polite message instead of going through.

Common mistakes to avoid

• Pasting a key into chat to "test if it works." Now it's in another system, possibly logged. Rotate the key instead — never type a real key into a conversation.
• Setting a "soft" budget alert instead of a hard cap. Alerts tell you something is happening; caps stop it. Use both, but the cap is what actually saves you money.
• Forgetting the .env file is special. Most AI coding tools know to ignore .env files when publishing your code. If yours doesn't, add .env to a file called .gitignore so the secrets never get committed by accident.
• Assuming "private repo" means "safe forever." Repos change visibility, links get shared, screenshots happen. The habits in steps 1–5 matter regardless of your current privacy setting.

Wrap-up

Vibe coding is a remarkable way to build something real without learning to code first. The tradeoff is that you also inherit responsibilities most developers take years to learn — and one of those responsibilities is keeping secrets secret. Six quick checks, half an hour, and you've closed the doors that catch most beginners.

Your next step: open your project right now and do step 1. Search for sk-. Whatever you find, you've already won — because now you can fix it.