API Key Security: How UK Businesses Expose Themselves Without Knowing

The API Key Problem Nobody Talks About

In October 2026, Railway — a popular cloud platform used by thousands of UK developers — suffered a security breach. Attackers accessed encrypted environment variables stored on the platform. Among the most valuable targets: Stripe secret keys, Anthropic and OpenAI API keys, and Supabase service role credentials.

This was not a rare event. It was the latest in a pattern of attacks specifically targeting platforms where developers store API keys. The attackers' goal is straightforward: steal the keys, sell them on a black market, and let buyers run unlimited AI inference or drain payment accounts before the breach is discovered.

The uncomfortable reality is that most UK businesses — from solo founders to growing SaaS companies — are storing their API keys in ways that create exactly this kind of exposure.

What Is an API Key and Why Does It Matter

An API key is a credential that grants programmatic access to a service. Your Stripe secret key authorises charges to customer cards, refunds, and subscriptions. Your Supabase service role key bypasses all row-level security and gives full read/write access to your entire database. Your Anthropic or OpenAI API key authorises AI requests billed to your account.

Unlike passwords, API keys are often not rate-limited, not tied to a [second factor](/blog/two-factor-authentication-website-security-uk), and in many cases not monitored for unusual usage. A leaked API key can be exploited for hours or days before the owner notices.

The damage varies by key:

**Stripe secret key** — An attacker can create charges to captured card data, create fake products, issue refunds to controlled accounts, or modify subscription structures. Financial damage can run to thousands of pounds within hours.

**Supabase service role key** — Full database access. Customer records, email addresses, hashed passwords, payment references, and any other data your application stores can be exfiltrated in minutes.

**AI API keys (Anthropic, OpenAI)** — Keys are sold to run inference for free. Bills of £2,000–£10,000 can accumulate overnight before automatic limits kick in, if they exist at all.

The Most Common Ways Keys Get Exposed

Hardcoded in source code

The most dangerous and surprisingly common mistake. A developer adds an API key directly to a configuration file, commits it to a git repository, and either pushes it to a public GitHub repo or — more subtly — leaves it in git history even after the key is removed from the current codebase.

GitHub's secret scanning feature catches many of these, but only on public repositories, and only for keys from services that have registered with the programme. Private repositories, GitLab instances, and self-hosted git servers have no automatic scanning.

Environment variables on compromised platforms

Environment variables are the standard alternative to hardcoding keys. Platforms like Railway, Heroku, Render, Fly.io, and Vercel all support them. This is the correct approach — but it transfers trust entirely to the platform.

The Railway breach of October 2026 demonstrates the risk. When a platform is breached, every customer's environment variables are potentially exposed. Customers have no control over the platform's security posture.

Leaked in client-side JavaScript

Keys that should only exist server-side are occasionally bundled into client-side JavaScript by accident. A developer uses a secret key in a frontend component, the bundler includes it, and anyone who views the page source or inspects the JavaScript bundle can extract the key.

This is particularly common with frameworks that blur the server/client boundary, where `process.env.SECRET_KEY` in the wrong file ends up rendered into the browser.

Shared in Slack, email, or documentation

API keys shared over Slack for debugging, sent in emails, or pasted into internal documentation remain accessible long after the original need. Slack message search, email archives, and Confluence or Notion pages retain keys indefinitely unless explicitly purged.

How to Store API Keys Properly

Use a dedicated secrets manager

Secrets managers are purpose-built for storing, auditing, and rotating credentials. They do not expose secrets as environment variables that can be read by anyone with platform access. Leading options for UK businesses:

**Doppler** — Straightforward UI, integrates with most platforms, audit logs for every secret access, automatic rotation for supported services. Free tier covers most small SaaS applications.

**HashiCorp Vault** — More complex but extremely powerful. Full audit trail, dynamic secrets (keys generated on demand and automatically revoked), fine-grained access policies. Better suited to larger teams or regulated businesses.

**AWS Secrets Manager** — If you are already on AWS, this is the natural choice. Per-secret pricing, automatic rotation for RDS and Redshift credentials, IAM-based access control.

**Azure Key Vault** — Equivalent for Azure workloads.

The key property of all these systems: secrets are fetched at runtime by your application, not injected as environment variables at deploy time. An attacker who compromises your deployment platform does not automatically get your secrets.

Rotate keys regularly

Most API keys never expire. A key issued two years ago and never rotated has been exposed to every developer who has left your company, every platform you have deployed on, and every third-party tool that has read your environment variables.

Set a calendar reminder to rotate every key quarterly. For sensitive keys — Stripe, Supabase — rotate immediately after any personnel change or platform incident.

Scope keys to minimum permissions

Stripe, Supabase, and most major API providers support restricted keys with limited permissions. A key used only to read subscription status does not need permission to issue refunds. A key used by a read-only reporting service does not need write access to your database.

Minimum-privilege keys limit the blast radius if a key is leaked. An attacker with a read-only analytics key cannot drain your Stripe account.

Monitor for unusual usage

Most API providers show usage dashboards. Stripe provides real-time transaction logs. Anthropic and OpenAI provide token usage by API key. Supabase logs database queries.

Set up alerts for anomalous usage — a spike in API requests, unexpected charges, queries from IP addresses that do not match your application's infrastructure. Most breaches are discovered through billing alerts, not security monitoring.

What Yrzo AI Checks

A Yrzo AI scan examines your web application for the most common forms of accidental key exposure:

- Client-side JavaScript bundles are scanned for patterns matching known API key formats (Stripe publishable and secret keys, Supabase anon and service keys, common AI provider keys) - HTTP response bodies are checked for key leakage in API responses - Public git repository exposure is verified for your domain's associated repositories where discoverable - Security headers are checked to ensure client-side script execution is controlled

The monthly monitoring plan rescans weekly — so if a deploy accidentally includes a key that should have been server-side only, it is caught before it is exploited.

Starting from £149 for a one-off scan, or £99/month for continuous monitoring. [Start a free scan today](/free).

Related reading: [What Is a Supply Chain Attack?](/blog/what-is-supply-chain-attack-website) · [How to Secure an API](/blog/how-to-secure-an-api-uk) · [Dark Web Monitoring for UK Businesses](/blog/dark-web-monitoring-uk-businesses)