I care less about what AI can demo
and more about what it can reliably do.
I spend my time on product taste, harnesses, and evals,
the unglamorous work that makes systems feel magical.
If that resonates, you'll like it here.
What I check before any AI app goes live:
• no secret in the frontend, ever
• .env in .gitignore before the first commit
• a secret scanner on every push
• a spending cap on every AI key
• if one leaks: rotate it first. Deleting the commit isn't a fix
Leaked API keys don't expire on their own.
GitGuardian retested secrets it had confirmed valid in 2022. In January 2026, over 64% still worked.
What the 2026 data says about AI-written code and leaked keys:
It's not only GitHub. Escape scanned 5,600+ public vibe-coded apps and found 400+ exposed secrets, including OpenAI keys and admin payment keys.
Many sat in frontend JavaScript bundles. Anything shipped to the browser is public.