My OpenAI API key has been stolen. I woke up today to find my credits used up and a series of strange requests. I never published the key anywhere other than in my project’s .env file.
I would very much like to be reimbursed, given that I did not make these requests myself. I find it unacceptable that the company lacks security mechanisms to prevent this from happening.
Welcome to the forum, and sorry to see if you have fallen victim to a key leak. However, that’s very unlikely to have happened within the OpenAI platform. You are responsible for the security of your key outside of the OpenAI platform.
Check your logs and also check for natural expiry of credits.
We cannot resolve your issue here as it is too sensitive, but please reach out to support@openai.com and open a case.
And of course cycle your keys immediately.
Hey anon30914191, that's definitely frustrating.
Along with merefield's suggestion to contact Support, I'd also recommend following OpenAI's best practices for securing your API keys going forward.
If you've already contacted Support, could you share your case number? I'll make sure it gets flagged to the appropriate team for review.
Avinash
Here are a few best practices worth following.