That's what I think too. A smarter way of doing it would be to route commands through a server the dev controls so they could put limits in and not expose the key, but I very much doubt that has happened.
I very much doubt that, routing the requests through a global server which then handles the requests it the only way to go. Nobody is that stupid that they directly allow access through an API key included in the game itself.
You wanna see the amount of slop that comes with vibe coding. I have seen endpoints not doing basic validation if a user has access to a specific resource to every secret in an project being committed to a public repository. Using chatGPT doesn't make you a programmer and it shows whenever you see the code quality from vibe coders
Maybe a year or two ago or with cheap models - any time you get close to talking about API keys and secrets, the AI will keep reminding you not to paste it in the chat. Of course, if the dev is dumb enough to do that themselves then it can get saved somewhere by accident; but, people have been known to do that sort of thing even before AI as well.
nah you luddites dont know shit. my vibe coded website is 100x better than anything you could make, and it took about 3 minutes to make. devs are cooked. check it out:
Yeah, no, unless we're talking about cheap LLMs run locally or something
Claude is SO pedantic about not even wanting keys in its chat cause now "anyone that could access this chat can read them" despite it running only on my dev server, it's almost annoying
And it'll bug me over and over about it if I ever do it, like it'll add "rotate that key" at the end of every message
At least they could limit what it is used for. Provide your api-key and someone gets free access to do what ever they want with your AI-subscription. Route the traffic trough an api you control, and you can set limits, check/validate the payloads and only return pre-defined payloads.
Setting up a reverse proxy that authenticates the requests and redirects them doesn’t make that high of a usage. It’s abysmal compared to requests hitting a db.
30
u/Mars_Bear2552 2d ago
this implies that game copies come with an API key