Bill-risk 100

You are fixing a leaked OpenAI API key in this app.

The public page includes an OpenAI key (it starts with sk-). Anyone who loads the site can copy it and spend this account's credits.

Do this:
1. Search the repo for the key prefix and for NEXT_PUBLIC_ or VITE_ variables that hold it. Remove the key from client components, HTML, and committed env files.
2. Move the OpenAI call into a server route, server action, or backend function. Read OPENAI_API_KEY from the server environment only.
3. Add a per-user rate limit and a max output token cap on that route.
4. Rotate the key in the OpenAI dashboard. Deleting it from the repo is not enough, because the old key is already in the bundle people can download.

Do not print the old key.

You are fixing a Supabase service_role key in the browser.

The service_role key bypasses Row Level Security. Anyone who copies it from the page can read and write rows the policies were meant to protect.

Do this:
1. Remove the service_role key from client code and from any NEXT_PUBLIC_ or VITE_ variable.
2. In the Supabase dashboard, revoke that key and issue a new one. Store the new key only as a server environment variable.
3. Keep the anon key in the browser. Turn on Row Level Security for every table in the public schema, and do not use a policy of using (true) for private data.

Burnproof did not send the service_role key anywhere.

Add a Content-Security-Policy header so the browser only loads scripts and connections you expect.

In Next.js, set headers() in next.config. Start with a policy that allows your own origin, then tighten it. A CSP does not replace moving API keys off the client.

Add Strict-Transport-Security so browsers stay on HTTPS after the first visit.

Example: Strict-Transport-Security: max-age=63072000; includeSubDomains

Only send this header on HTTPS responses.

Add the header X-Content-Type-Options: nosniff so browsers do not treat a file as a script when its content type says otherwise.

In Next.js, add it in next.config headers().

Stop other sites from embedding this app in a frame.

Add X-Frame-Options: DENY, or a Content-Security-Policy frame-ancestors 'none'. In Next.js, set it in next.config headers().

Add Referrer-Policy: strict-origin-when-cross-origin so the browser does not send full page URLs to other sites.

In Next.js, set it in next.config headers().

Add a Permissions-Policy header that turns off camera, microphone, and geolocation unless a feature needs them.

Example: Permissions-Policy: camera=(), microphone=(), geolocation=()