Skip to main content
All rules

SEC-020

Browser calls an AI provider API directly

HighDefault severity · Security · Secrets, HTTPS and security headers

Last reviewed

What it checks

AI provider API hostnames inside the site’s client-side JavaScript.

Why it matters

Calling an AI provider from the browser means the API key ships to every visitor, who can then spend your quota.

Recommended fix

Proxy AI requests through your own server route that holds the key, checks the user and applies rate limits.

How to verify

Search the built JavaScript for the provider hostname and confirm it no longer appears; confirm chat still works.

Example fix prompt

Generic prompt (your report adds the evidence)
Please fix this production issue in my app.

Issue SEC-020: Browser calls an AI provider API directly
Site: https://your-app.example

First confirm the issue in the code or live config. If it is not present, say so and change nothing.
Task: The frontend calls an AI provider API directly. Create a server-side route that makes the provider call with a server-only API key, require a signed-in user (or a strict anonymous rate limit), cap max tokens, and change the frontend to call that route instead.

Constraints: make the smallest change that fixes this, keep the current design and behaviour, never paste secret values into code or chat, and tell me which files you changed.
Done when: Search the built JavaScript for the provider hostname and confirm it no longer appears; confirm chat still works.

References