API Keys Leaked for 4 Days, $250 Burned: The Culprit Was an Unpatched Next.js RCE
Ubunta · x · 2026-10-14
A developer recounts a 4-day key-leak incident: Claude and OpenAI API keys kept leaking, re-leaking immediately after rotation, costing about $250. Key lessons from the postmortem:
- AI agents investigating the issue produced plenty of confident but wrong answers. The real breakthrough was one small detail: only keys inside running pods leaked, never the one on the laptop — meaning the problem was on the server, not the keys.
- The culprit was an unpatched vulnerability in their Next.js/React stack allowing unauthenticated remote code execution; attackers could read anything the affected process could access, including the keys.
- The fix took 10 minutes; finding it took 4 days.
Practical advice: patch frameworks, not just your own code; close the hole before rotating keys, or you're handing attackers fresh credentials; compare what leaked with what didn't — the difference is your biggest clue. The author's takeaway: AI did the work, but asking the right question and pointing agents at the right comparison still came from a human.
Related event: Next.js RCE Vulnerability Behind 4-Day API Key Leak Costing $250(2 posts)→
More from coding & agent
- Claude Made a Styled Video in Four Steps—and Caught a One-Pixel Flaw Itself — aakashgupta · 2026-10-16
- Datadog Launches Scout 1.0, an RL-Trained Model for Investigating Production Incidents — HanchungLee · 2026-10-16
- Microsoft paper: history-aware model routing lifts multi-turn agent task pass rate by 3.3 points — dair_ai · 2026-10-16
- ORA: open robot-use agents powered by DeepSeek V4.1-Flash compete with frontier models — JunGao33210520 · 2026-10-16
- Non-developer ships a full platform fighter in 30 days with AI agents — Teknium · 2026-10-16
- 2 humans + 5 agents: plain-English feature requests now drive their codebase autonomously — nptacek · 2026-10-16