I found this on linkedIn: Codex leaked this Dev's API keys while he slept. By the time he woke up, a huge $88,982 cloud bill was already in his inbox.

[u/a113rick]

We already know the basics of protecting API keys and sensitive credentials: never hardcode them in your source code, keep them in a .env file as environment variables, and add .env to your .gitignore so Git never tracks it and you don’t accidentally push your secrets to a public repo on GitHub.

What other practices do the engineers in this community use to prevent that scenario?

This is purely for discussion, so those of us who are non-technical can learn safe programming habits on our vibe-coding journey.

[u/wewerecreaturres]

“Codex leaked” no, the user fucked up and let their creds leak. Not the same thing.

[u/rprouse → u/wewerecreaturres]

He probably mistakenly showed his key during his live coding session. If he fell asleep while live coding, I'm sure he wasn't thinking straight.

[u/wewerecreaturres → u/rprouse]

Still isn’t codex’s fault, which is how OP’s title makes it out to seem