Your app is showing a secret key. Do this, in this order.

Someone (possibly this site's security check, possibly a stranger) told you a secret key is visible in your app. The order of operations matters more than speed on any one step.

1. Rotate the key at its source, before removing it from the app

Removing the key from your site does nothing while the old key still works; anyone who saw it can keep using it. Kill the key where it was issued:

• Stripe: Dashboard → Developers → API keys → roll the secret key. (Keys starting sk_live are secret; pk_live is public by design and fine to see in a page.)
• Supabase: Project settings → API. The anon key is public by design; the service_role key is the dangerous one; if that's what leaked, regenerate it here.
• OpenAI / Anthropic: the API keys page in each console: revoke the exposed key, create a fresh one.
• AWS (keys starting AKIA): IAM console → deactivate the access key, create a replacement. Then check the billing page today, not next week.

2. Now remove it from the app

Paste this to whatever AI builds your app:

Then put the new key wherever your host keeps secrets (in Plyo: Settings → Secrets & settings), republish, then run the key-leak scanner against your live site to confirm the new key is nowhere in it.

3. Assess the damage

Check the provider's usage or billing page for activity you don't recognize during the exposure window. Stripe additionally shows an event log of every API call. Nothing unusual is the common outcome when you rotate fast, but look.

4. Stop the repeat

The same mistake ships again unless something checks. Ask your AI to keep all keys server-side as a standing rule, and scan before each launch. The manual 20-minute check works, or Plyo does it automatically: it scans every publish for exposed keys and blocks the serious ones before they go live, explaining the fix in plain English.