AI API called directly from the browser
Scan rule · RSC-SEC-021
- Security
- Severity: High
- CWE-798
Observes calls to LLM providers from the client — the required key is exposed and any visitor can generate on your bill.
Scan tier
- Browser runtime
How to fix it
Route LLM calls through your own server endpoint with auth and usage limits.