Hard-coded API key in the codebase
A developer ships a side-project. The OpenAI key sits right next to the React component. It lands in Git, in the bundle, on a contractor's laptop.
const client = new OpenAI({ apiKey: "sk-proj-abc123…"});await client.chat.completions.create({…}); const client = new OpenAI({ baseURL: "https://gw.acme.io/api/<uuid>/v1", apiKey: process.env.PG_TOKEN // pg_live_…});