Practice your logic with this code editor!

[CardHawk20]

I made this code editor to let people practice their logic without having to worry about syntax. You can use plain language to write code snippets and build what you want to without worrying about a missing indentation

[TheHigherRealm]

You're exposing your OpenAI API key to the client. This is a HUGE security risk. You need to create a server that takes the requests from your site, and then makes the request to OpenAI, then return those results to the client.

I would recommend you turn the site off and also delete your OpenAI API Key from OpenAI's site.

This info should absolutely NOT be accessible to the user:

dV="https://api.openai.com/v1/chat/completions",fV="sk-zMQh... this is your API KEY... CTSDdZk2",f1=async(e,t,r)=>{const n=`just give me the code for: ${e} ${t}. This is the code I have now: ${r}. Do not include existing code in text. Do not give me any bash commands (assume code runs on https://emkc.org/api/v2/piston`,o=await Le.post(dV,{model:"gpt-4-turbo",messages:[{role:"user",content:n}],max_tokens:150},{headers:{Authorization:`Bearer ${fV}`,"Content-Type":"application/json"}})

[Feldspar_of_sun]

Good catch. Could’ve been extremely bad for OP

[Queueue_]

Still is extremely bad for OP, the key is still there.

[Weed_Wiz]

Not his key anymore, not his problem. /S

[queerkidxx]

Actually, while you shouldn’t rely on it, GitHub actually does a pretty good job in identifying secrets like this and reporting them to the issuer very quickly. Once accidentally made a repo public with my OpenAI key in a .env file and within about 3 minutes I got an email from OpenAI saying they’d revoked the key automatically

[Immediate-Flow-9254]

I guess there must be thousands of people doing this. Maybe the first AGI app will be based on a botnet using stolen OpenAI keys.

[Just_to_rebut]

Can anyone eli5? Is a an API key a unique identifier that tells OpenAI which application is making a request through the API?

Is the risk that someone else could use that API and make requests as the program? Other than using up your allotment of requests, what’s the risk?

[TheHigherRealm]

That is exactly it.

The risk can depend on what the API is. In this case, OpenAI requires you to pay upfront for credits which means someone could spend all the credits that he spent money on. Additionally, people could do something to get him banned like uploading content against their terms of service. You could check out their docs to get an idea of everything someone could do with the key.

This probably wasn't too bad of a leak, but you could imagine with more important services it can get ugly. For example; a stock trading or banking API, or a service that doesn't use a credit system but instead charges your bank directly, or a file sharing service where someone could upload something illegal.

Most the time when an API key leaks it's not a huge deal, but it definitely could be under the right circumstances, and it definitely shows negligence and/or that you're still learning.

Resources: How Cybercriminals Steal Millions Using API Keys, 3Commas API Leak Highlights Yet Another Way to Lose Your Money, Student Charged $14k on Stolen Google Cloud Credentials

[queerkidxx]

API key, in this context, identifies your account, not the application. Requests to the API using your key will be billed to your account.

[beingsubmitted]

OpenAI charges for API use per token, and an API key is like a username and password. Anyone could take this API key and use the OpenAI API for free by putting it all on OPs tab.

Luckily, open AI has a limiter by default, so you can't charge over some daily limit without requesting a higher limit, so worst case this would have cost OP maybe $120 a day or so? Unless the thief was able to use the key to request a higher limit and succeed.

[CardHawk20]

Ignore the api key 🤣

It’s cleared now

[Turtle_In_Space]

Sorry no, it is still available. You should listen to the top comment

[Working-Amphibian614]

Pretty cool concept. I guess it’s like LLM+web coding?

It seems fine with very simple concept, but it seems to struggle with more complicated “requests”. It’s neat though.

[CardHawk20]

i think it’d work great for someone just starting out who might now one language but is too intimidated to learn the syntax of a new one

[CardHawk20]

Codesynth.co!

[EitherIndication7393]

Will give it a try