Description
The OpenAI API key is exposed to the client-side bundle through a \VITE_\ prefixed environment variable, making it trivially extractable by anyone who opens the browser's DevTools.
Location
\src/services/aiAnalysis.ts:9\
\\ ypescript
const OPENAI_API_KEY = import.meta.env.VITE_OPENAI_API_KEY;
\\
This key is used directly in \ etch()\ calls to \https://api.openai.com/v1/chat/completions\ at:
- \src/services/aiAnalysis.ts:36-66\ (analyzeAnswer)
- \src/services/aiAnalysis.ts:154-182\ (analyzeWriting)
- \src/services/aiAnalysis.ts:255-281\ (generateConversationResponse)
All three pass the key in the \Authorization\ header:
\\ ypescript
headers: {
'Content-Type': 'application/json',
'Authorization': \Bearer \
},
\\
Impact
In Vite, all environment variables prefixed with \VITE_\ are compiled into the client-side JavaScript bundle at build time. They are not server-side secrets. Any user can:
- Open browser DevTools (F12)
- Search for \sk-\ or \Authorization\ in the bundled JS
- Extract the complete API key
A stolen OpenAI API key exposes the account to:
- Financial liability: Unauthorized API calls can rack up significant charges
- Rate limiting / suspension: Abuse could lead to the account being throttled or banned
Suggested Fix
Create a backend proxy endpoint (or serverless function) that receives requests from the frontend and forwards them to OpenAI. The API key should only exist server-side.
\
Frontend (browser) → POST /api/analyze → Backend/Serverless Function → OpenAI API
\\
Severity
Critical — active financial exposure, trivially exploitable, affects all users of the deployed application.
Description
The OpenAI API key is exposed to the client-side bundle through a \VITE_\ prefixed environment variable, making it trivially extractable by anyone who opens the browser's DevTools.
Location
\src/services/aiAnalysis.ts:9\
\\ ypescript
const OPENAI_API_KEY = import.meta.env.VITE_OPENAI_API_KEY;
\\
This key is used directly in \ etch()\ calls to \https://api.openai.com/v1/chat/completions\ at:
All three pass the key in the \Authorization\ header:
\\ ypescript
headers: {
'Content-Type': 'application/json',
'Authorization': \Bearer \
},
\\
Impact
In Vite, all environment variables prefixed with \VITE_\ are compiled into the client-side JavaScript bundle at build time. They are not server-side secrets. Any user can:
A stolen OpenAI API key exposes the account to:
Suggested Fix
Create a backend proxy endpoint (or serverless function) that receives requests from the frontend and forwards them to OpenAI. The API key should only exist server-side.
\
Frontend (browser) → POST /api/analyze → Backend/Serverless Function → OpenAI API
\\
Severity
Critical — active financial exposure, trivially exploitable, affects all users of the deployed application.