Apr 27, 2025
How to Rotate sk_live_, vercel_token, sk-proj Exposed in .env
We found live API keys in 0.45% of public Vercel deployments. AWS credentials, Stripe secrets, GitHub tokens. Here is what exposes them (NEXT_PUBLIC_ misuse is only one), how attackers chain a single key into full cloud compromise, and what to change in your setup this week.
Ben Kim
Founder & CEO
