-
Security
Find and fix exposed environment variables
Scans your client-side code for API keys and secrets that should live on the server, then moves them behind a safe API layer.
Free Prompt
Scan my client-side code for API keys, secrets, and other sensitive values that should only exist on the server. For each one you find, move it behind a server-side API endpoint and update the client to call that endpoint instead. Never expose secrets to the browser.
What This Does / How This Helps
Finds any API keys or secrets that leaked into your browser-facing code — a common vibe-coding accident — and moves them behind server-side endpoints where they belong. This closes the hole that lets anyone open dev tools, steal your keys, and run up bills or access your data.
Want to skip doing this by hand?
Fortivibe audits your app for all of the areas these prompts cover (and more).