AINewsnow

Why Cursor Ships Your OpenAI Key to Every Visitor (CWE-522)

This story is from 2026-10-13. It is preserved in the archive; the latest stories are on the live feed.

TL;DR When the OpenAI SDK throws "It looks like you're running in a browser-like environment", AI editors usually fix it by adding dangerouslyAllowBrowser: true and moving the key into a VITE_ or NEXT_PUBLIC_ variable. That ships your secret API key to every visitor. It sits in the JavaScript bundl…

Read the full story at DEV Community — AI ↗

Timeline · 1 report

  1. 2026-10-13 17:31 · DEV Community — AI
    Why Cursor Ships Your OpenAI Key to Every Visitor (CWE-522)

More stories

  1. Multi-agent orchestration with Claude Pro + Google AI Pro + Cursor: how do you actually set this up without burning your limits? — r/AI_Agents
  2. UI Laggy: The worst experience I’ve ever had with ChatGPT — r/ChatGPT
  3. We audited CodeRabbit's enterprise case study: 174 engineers (~$41,760/yr) to reduce AI PR merge time from 16.8h to 16.7h (6 mins). Why AI coding needs a 3.8s local AST airlock instead of another PR chatbot. — r/ChatGPTCoding
  4. Gemini 4 Argon is now available for developers. — Google Gemini Blog
  5. Block on Finding and Fixing Security Risks with OpenAI — OpenAI YouTube
  6. SpaceXSI bundles X Premium, Grok, and Cursor into one subscription — TechCrunch AI
  7. Users report Qwen 3.8 Flash Next performance on local hardware — r/LocalLLaMA
  8. Qwen-Image 2.1 Turbo model is available in ZPix (a friendly local image generator and editor) — r/StableDiffusion

Get the daily brief of stories like this at 6:30 every morning →