AI API called directly from the browser (statically proven)

Server code does not end up in the browser. If an AI provider's address sits in the shipped bundle, the visitor's browser is making the call — and that call needs a key, which is therefore reachable.

The damage is not abstract: whoever pulls the key from the dev tools keeps generating on your bill until the budget or the limit runs out. With AI providers that happens fast and often surfaces only on the invoice.

Until now only the scan's optional browser run found this, and it rarely runs. The static proof is enough — and the fix is the same either way: move the call behind your own endpoint, authenticate there, cap usage, rotate the key.