AI keys in public JS: someone else burns your quota

sk- and sk-ant- on the storefront are a bill, not a config. One-minute check.

Front ends sometimes ship a model key “for speed”. Anyone with DevTools can burn OpenAI/Anthropic/Gemini quota on your account.

Orb44 only reads the public homepage and same-host scripts. We do not clone repos or run AI-code SAST.

If red — rotate the key and keep it server-side. Green means we did not see known patterns on this page.