For Cursor Users

Stop Pasting API Keys Into Cursor

It's 11pm. You're deep in a Cursor session, building a payment integration. The AI generates a Stripe webhook handler and asks for your secret key to test it. You paste sk_live_... into the chat. You've done it a dozen times. It works. You move on.

Here's what actually happened: that key is now in Cursor's conversation history. It exists on servers outside your control. If Cursor uses a third-party AI provider to process your prompts (it does), your live Stripe key was transmitted to that provider's infrastructure. You have no way to audit where it went, no way to delete it, and no way to know if it will appear in future model outputs.

Security researchers at Escape.tech scanned 5,600 publicly deployed apps built with AI coding tools in 2025. They found over 400 exposed secrets. Many were traced back to development workflows exactly like the one above.

The fix takes 3 minutes and changes nothing about how you use Cursor.

The Pattern Transformation

✗ What you're probably doing

const openai = new OpenAI({ apiKey: 'sk-xxxxxxxxxxxxxxx' });
// This key is in your Cursor conversation history.
// It's in your codebase. It's one git push from being public.

✓ What you should do instead

async function getOpenAI() {
  const res = await fetch(
    'https://app.kevorax.com/api/runtime/secrets/OPENAI_API_KEY',
    { headers: { 'Authorization': `Bearer ${process.env.KEVORAX_TOKEN}` } }
  );
  const { value } = (await res.json()).data;
  return new OpenAI({ apiKey: value });
}

// KEVORAX_TOKEN is the only thing in your .env
// Your actual OpenAI key never appears in your code
// It never appears in your Cursor prompts
// Every access is logged
// Rotate it once in Kevorax — all your projects update automatically