Fix guides
Every credential KeyDrift detects, crossed with the tool that put it in your bundle. Each guide explains why that tool produces the leak and gives the exact change that moves the call back to a server.
Cursor
Cursor edits the file you have open. Ask it to "call the OpenAI API" from a component and it writes exactly that — a client component holding a key — because the request named a file, not an architecture. The agent has no way to know the module is bundled for the browser.