vetkit.llm-app.llm-api-key-in-client
The Vite define option copies an LLM provider API key into the client bundle. Every visitor of the app can read the key and call the provider on your account. An LLM provider API key is used by code that runs in the browser. Anyone who opens the app can read the key from the bundle or the network tab and call the provider on your account.
Last updated:
Suite: AI code risks
javascript, typescript
The Vite define option copies an LLM provider API key into the client bundle. Every visitor of the app can read the key and call the provider on your account.
Category: LLM SECURITY · Engine rule severity: WARNING
How to fix it
Remove the key from define, move the model call to a server route or serverless function that reads the key from a server-only environment variable, and rotate the exposed key.
References
Source: packages/engine/rules/llm-app/config.yml.
javascript, typescript
An LLM provider API key is used by code that runs in the browser. Anyone who opens the app can read the key from the bundle or the network tab and call the provider on your account.
Category: LLM SECURITY · Engine rule severity: WARNING
How to fix it
Call the model from a server route that keeps the key in a server-only environment variable, authenticate and rate-limit that route, and rotate the exposed key. dangerouslyAllowBrowser is only appropriate when every user supplies their own key.
References
Source: packages/engine/rules/llm-app/javascript.yml.
Generated from shipped rule definitions at build time. Matching is a review signal, not proof of exploitability. “generic” denotes text matching, not complete language or framework coverage. Runtime configuration and available tools affect whether a rule runs.