OpenAI API key

How it is detected

Matches the modern `sk-proj-`, `sk-admin-` and `sk-svcacct-` prefixes over the full base64url alphabet, so a key containing `-` or `_` is captured whole rather than truncated at the first one.

If you find one

1. 1Revoke the key at platform.openai.com/api-keys.
2. 2Check usage for the billing period — exposed keys are usually found by scrapers within minutes, and the charge lands before the alert does.
3. 3Put the API call behind a server route with your own rate limiting, so a leaked route costs less than a leaked key.

Where it turns up

Most often in chat features calling the API directly from a React component.

Fix it in your stack

• Lovable
• Bolt.new
• Cursor
• Claude Code
• Replit
• Next.js