I Leaked an API Key and Learned the Boring Lesson

I pasted an API key into a script, committed it to a repo I thought was private, and got a charge I didn't recognize three days later. Nobody hacked me. I just left the door open and someone walked in.

The fix was boring and total: rotate the key, move secrets to environment variables, add a pre-commit check that catches a key-shaped string before it ever leaves my machine. None of it was clever. All of it was necessary.

What surprised me was the speed. The bad charge showed up faster than I'd have noticed a typo in my own code. Bots scrape public repos for keys within minutes, and a repo that gets pushed anywhere public is a leak waiting to happen.

I now treat every key as burned the moment it touches a file that could be shared. The ten seconds it takes to use a variable instead of a literal has paid for itself more than once.

Nobody warns you about this because it isn't a feature. It's hygiene. But the bill is the same whether the breach was glamorous or just careless, and mine was the second kind.