The key that leaks is the one with a credit card behind it
A leaked model API key is not a data breach. It is a bill, and it arrives fast.
- The setup
- Small team shipping an AI product. Several model providers, metered per token.
- In play
- Model provider keysLocal prototypingFast iterationMetered billing
A model provider key bills per token, with limits set high enough not to interrupt legitimate work. That combination makes it the most immediately expensive credential most teams hold.
It is also the one that circulates most, because prototyping against a model is something everyone on the team does, in notebooks, in scratch scripts and in half-finished branches.
What breaks
Exposure converts to spend within hours
Scanners find and test credential patterns quickly, and unlike a database credential there is no lateral movement required to monetise a model key. It works immediately, from anywhere.
Prototype code is where it leaks
Notebooks, scratch files and quick branches are written to be thrown away, so they are written without the care that production code gets. They are also frequently committed.
Everyone needs one, so everyone has a copy
Engineers, the person doing prompt work, the designer trying something — all of them need model access, and the path of least resistance is one shared key pasted into a channel.
A spend spike is the detection mechanism
For most teams the first signal is the billing alert, which means the exposure is measured in hours of unexplained usage rather than minutes.
How it works here
Not in the working tree
The vault is outside your project directory, so the notebook you commit without thinking has nothing to pick up.
Insert into the notebook, not the clipboard
The VS Code extension puts the value at the cursor when you need it, so the value does not pass through the clipboard on the way to a scratch file.
Share access, revoke it cryptographically
Give the person doing prompt work access to the project rather than the key string. When the contract ends, revocation rotates the project key rather than trusting them to delete a message.
One place to update after rotation
Because a rotation is a single edit in the vault, the response to a suspected leak is minutes of work rather than an afternoon, which is what makes rotating on suspicion realistic.
Closest to your setup?
Install the extension, import an existing .env, and check the fit against your own projects. It works offline and nothing is uploaded unless you sign in.