How I Stole Your ChatGPT API Keys

Security fundamentals for the front-end

The AI gold-rush is in full swing.

And in a gold rush, baddies will steal shovels.

One deadly mistake is commonplace: bundling ChatGPT API keys directly into your shiny new AI app. This makes it trivial to steal your keys, burn through your credits, and rack up painful bills.

Today, I’ll explain a fundamental Security Law:

Don’t store API keys on the client.
Like, ever.

Today, we’re looking at the two main ways bad actors can sniff out your API keys; then we’ll learn how you can avoid this fate.