The key you deleted
Your AI committed a file with your . You deleted it in the next commit and made the repo public a week later. The key is being used.
This answers: Deleted my API key from GitHub. Still exposed? No coding needed. 3 quick decisions.
- Keys and secrets
- Supervising your AI
Checking your access…
Deleted my API key from GitHub. Still exposed?
Yes, if it was ever committed. Git keeps every version of every file, so the key is still in the repository history, and bots scan public repositories quickly. Revoke the key and create a new one first, then clean the history, and turn on secret scanning with push protection.
Breaks at GitHub: Key still in git history
How it works
Your server: private
Every visitor's browser: public
Why AI tools write this bug
AI tools sometimes hard-code a key 'temporarily' to get something working, and the next commit removes it, which only hides it from the latest version.
How to fix it
- Revoke the exposed key immediately and issue a new one.
3 more steps, and a prompt that checks your own app for this bug. Part of Pro.
UnlockCommon questions
- Does making the repo private fix it?
- No. Anyone who already copied the key keeps it. Only rotating the key makes copies useless.