OpenAI or Gemini key in your frontend? Move it to an Edge Function

Exposing OpenAI or Gemini API keys in frontend JavaScript allows visitors to steal keys and bill requests to the owner. To fix this, developers should store keys as server secrets and use Edge Functions for authentication. Separately, OpenCode reported a security breach affecting 1.4% of Console users with linked external providers. Anthropic and Google responded by revoking and blocking affected Claude and Gemini API keys, while OpenCode continues investigating the ongoing incident as of October 2026.