What is Bundle?
The code files your website sends to every visitor's browser. Anyone can open and read them.
Where Bundle goes wrong in real apps
Each of these is a short scenario built from a real failure in an app made with AI. Read the answer here, or walk through it yourself in about four minutes.
Money and secrets · 4 minutes · Free
The key in the bundle
Your OpenAI bill jumped from $40 to $3,900 overnight. Your app has 60 users.
Walk it, freeIs my API key exposed in my frontend code?
If the key is in a variable with a public prefix such as NEXT_PUBLIC_, VITE_ or EXPO_PUBLIC_, or used in client code, it is in your JavaScript bundle and anyone can copy it. Revoke the key, create a new one, and call the paid API from your server only.
Related terms
- API
- The part of an app that other programs talk to. Your app's pages ask its API for data, like a waiter taking orders to a kitchen.
- Endpoint
- One specific address on your server that does one job, like /api/invoices. Each one needs its own safety checks.
- Server
- A computer that runs your app's code out of sight. Users can't change what happens there, which is why checks belong there.
- Browser
- Chrome, Safari and friends. Everything that runs here is visible to, and changeable by, the person using it.
- Secret key
- A password your app uses to talk to a paid service. Anyone who sees it can use it, and spend your money.
- Public prefix
- Starting a setting's name with NEXT_PUBLIC_ or VITE_ copies its value into your website, where anyone can read it.