Scan rule · RSC-SEC-021
AI API called directly from the browser
SecuritySeverity: HighCWE-798
Observes calls to LLM providers from the client — the required key is exposed and any visitor can generate on your bill.
Scan tier
Browser runtime
How to fix it
Route LLM calls through your own server endpoint with auth and usage limits.