Problem guide
Secrets exposed in an AI-built app
If a key, token, or password landed in the repo, the client bundle, or a chat log, treat it as burned. Rotate it before you do anything else. Then fix how the app loads secrets so the next agent session does not put it back.
What to do
- Rotate every exposed key before other work
- Strip secrets from git history where you can
- Load them from server-only env or a secret manager
- Stop the client bundle from embedding privileged keys
- Add a CI check so they do not return
This is the short path from a demo to an incident. Rotation and config hardening come first on every rescue we take.
Rescue by tool
FAQ
Can Meridian help with secrets exposed in an ai-built app?
Yes. Bring it as a diagnostic. We will rank how bad it is and, if salvage makes sense, quote a fixed scope.
See also pricing and rescue vs rewrite.
If the app is stuck, start with a diagnostic.
Tell us what you built and what is in the way. Written scorecard within about 48 hours of access.