You have 4 AI-built apps and 1 set of API keys. Here is how to stop that before it bites.
It starts with one app and one .env file. Three apps later the same OpenAI or Stripe key is in all of them and nobody remembers which. This is the cleanup.
Seven rules
- One key per project, never shared. If a key leaks from app A you revoke it and apps B and C keep working. One shared key means one leak breaks everything.
- Separate dev and prod values. Your laptop gets test keys. The live app gets the real ones. Many providers issue test keys for exactly this.
- Write an inventory. A simple table: project, provider, which key, where it is stored, when it was made. Ten lines in a note beat trying to remember.
- Give each key the smallest permission it needs. A key that only sends email should not be able to delete your account. Most providers let you restrict keys.
- Frontend variables are public. Anything with a prefix like NEXT_PUBLIC_ or VITE_ is shipped to the browser. Secrets do not go there.
- Know where else keys end up. Chat messages with the agent, screenshots, build logs and old git commits. Deleting a line from .env does not remove it from history. If a key was ever committed, treat it as leaked and rotate it.
- Rotate on a schedule, or when someone leaves. Make the new key first, switch the app over, then revoke the old one.
Tell the agent the rules up front: read keys from environment variables only, never print them, never write them into files that get committed. It follows that well.
Inventory template
- Project | Provider | Key name | Scope (dev or prod) | Where stored | Created | Last rotated
Prompt: audit this project's secrets
Paste this into Claude Code, Cursor, Codex or any agent that can run commands.
Read https://portal.traceshield.app/agent.md and follow it. Audit the secrets in this project. List every key the code reads and where it comes from. Make sure none are committed to git or sit in frontend-prefixed variables (NEXT_PUBLIC_, VITE_). Make the code read process.env only, set the values as environment variables with dev and prod kept separate, and never print a secret value. Tell me which keys I should rotate and give me the inventory table to keep.
What Traceshield does here, and what it doesn’t
Each Traceshield project has its own dev and prod environment variables, and your agent sets them through the API so you never paste a key into chat. It does not rotate keys at the provider for you.
More guides
Updated 2026-10-27. Written by the Traceshield founder.