-3

I’m facing a serious issue and need help identifying the cause.

My application setup is:

  • Backend: Python FastAPI

  • Frontend: Next.js

  • Auth: JWT (Bearer token)

  • Hosting: Nginx on a Linux server

  • OpenAI API Key: Stored in a .env file on the server

The API keys are not sent to the frontend, and they are never exposed to users. The .env file is owned by www-data and has permission rw-r--------, so only the application user can read it.

However, the OpenAI API key gets leaked within a day after recharging it, even though it’s used only on the backend. I have no logs or code paths that expose the key, and no one else has server access.

I’m trying to understand:

  • What could cause a backend-only API key to be leaked?

  • Could this be due to a server misconfiguration, a dependency vulnerability, or some kind of intrusion?

  • What steps should I take to diagnose and secure my server and application?

Any guidance or similar experiences would be highly appreciated. This issue is becoming critical.

Improve this question
New contributor
Deeksha Nagesh is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
5
  • 1
    "Could this be due to a server misconfiguration, a dependency vulnerability, or some kind of intrusion?". Yes. Also, if it's owned by www-data, and the application is running as that user, are you 100% certain the file cannot simply be requested through a simple HTTP request? What do your logfiles indicate? Commented Nov 25 at 12:48
  • 1
    How do you know it's been leaked; and what makes you think the leak must have been your server? Commented Nov 25 at 13:34
  • So you said "only the application user can read it", what do you think will happen if the "application user" read the file in a Windows box, but his/her box is infected with a trojan horse ? Commented Nov 25 at 14:20
  • @C3roe . I get an email from the openai community that the api key is disabled as it is being leaked . Commented Nov 26 at 6:14
  • 1
    Move secrets out of plain .env into a secrets manager (Vault / AWS Secrets Manager / GCP Secret Manager / Azure Key Vault). If not possible immediately, ensure file is outside webroot with strict perms (you already have rw-r-------- — good but still assume compromise). You can also try the option of limiting the IP address on Open AI dashboard Commented Nov 26 at 8:05
Related questions
10
How to access FastAPI backend from a different machine/IP on the same local network?
2
Call openai-node in the backend or call https in the frontend?
1
Vercel Error: (Azure) OpenAI API key not found

0

Reset to default

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.