Your Bolt.new app is serving its resend api key to every visitor

Why Bolt does this

Bolt scaffolds Vite projects inside a WebContainer, where everything runs in the browser by definition. Code that works in the preview keeps the key client-side when it is deployed, because nothing in the generated project ever moved it to a server.

Confirm it first

Before rotating anything, check whether the key is actually being served. Paste your deployed URL — KeyDrift downloads the same JavaScript a visitor gets and tells you what is in it.

Rotate the key

Do this before changing any code. The key has been served to browsers, cached by CDNs and very likely scraped already — removing it from the source does not un-publish it.

1. 1Revoke the credential with its provider. Rotation is the only fix — the key is in the browser cache, in CDN edge nodes, and in whatever scraped the page.
2. 2Review the account for activity you did not initiate.
3. 3Move the call that needed it to a server route, so the browser never receives the replacement.

Move the call to a server

The replacement key must not follow the old one into the bundle, which means the code that uses it cannot live in the browser. Any variable named VITE_… is inlined at build time by design — the prefix is the mechanism, not a mistake.

// src/components/Chat.tsx
// Vite substitutes the literal value here at build time.
const key = import.meta.env.VITE_API_KEY;
const result = await callTheApi(key, body);

// supabase/functions/proxy/index.ts  — runs on a serverless function on your deploy target
Deno.serve(async (request) => {
  const key = Deno.env.get('API_KEY')!; // never sent to the browser
  const result = await callTheApi(key, body);
  return Response.json(result);
});

// src/components/Chat.tsx
const result = await fetch('/functions/v1/proxy', { method: 'POST' }).then((r) => r.json());

How KeyDrift detects it

Matches the two-segment `re_` key format.