{"slug": "our-api-key-got-stolen-by-bots-so-we-rebuilt-the-whole-backend-in-48-hours-and", "title": "our API key got stolen by bots so we rebuilt the whole backend in 48 hours 😭🔒 (and now my chats follow me everywhere)", "summary": "A developer behind the AI mentor app KODA rebuilt its backend in 48 hours after bots found an API key exposed in frontend JavaScript and drained the project's credits overnight. The rebuild moved the key into a Cloudflare Worker with an automatic model fallback chain, shifted chat storage to Supabase with Row Level Security so users can only read their own rows, and added database triggers for referrals — all deployed from a $150 Android phone.", "body_md": "okay so real talk.\n\nlast week our AI mentor KODA had its API key sitting in the frontend code. \n\nand the internet did what the internet does: **bots found it and drained our credits overnight.** 💀\n\nwe didn't cry. we didn't quit. we rebuilt the entire infrastructure in 48 hours from a $150 android phone. here's the story, no corporate speak, we promise.\n\nour key was naked in the JavaScript. anyone could right-click → inspect → steal. \n\nand they did. credits: gone. dreams: temporarily paused.\n\nlesson learned the hard way: **never trust the client. ever.**\n\nwe moved the key into a **Cloudflare Worker** (basically a tiny server that lives in the cloud and costs $0). \n\nnow the flow is:\n\nyour browser never sees the key again. the bots are officially locked out. cry about it 🤡\n\n**bonus flex:** if one AI model dies or rate-limits, the Worker automatically hops to the next model in a fallback chain. KODA literally heals itself mid-conversation. self-healing AI on a phone budget. we're so back.\n\nthis is the part that broke our brains.\n\nwe had two URLs: a temp testing one and the main production one. \n\nwe chatted on the temp URL… then opened the main URL… \n\n**AND THE EXACT SAME CONVERSATION WAS THERE.** 😭\n\nwhy? because your chats don't live in your browser anymore. they live in a **cloud database (Supabase)** tied to YOUR account, not to a URL. \n\nwe even watched localStorage get buried next to it. pour one out. 🪦⚰️ (see the tombstone on the cover, we paid our respects)\n\n\"but bro, can't people just read everyone's chats from the database?\"\n\nnope. we used **Row Level Security (RLS)** — think of it as a bouncer built INSIDE the database. every row checks: *\"does this user own this row?\"* if not → rejected. even if someone bypasses the whole frontend, postgres itself says **nah bro.** 🚫\n\nwe also built referrals directly into the database with **triggers**:\n\nno manual work. no spreadsheets. the database runs the growth engine while we sleep. 😴\n\nwe got breached because we rushed. \n\nwe got bulletproof because we refused to stay broken.\n\nevery founder will get punched by production eventually. the ones who win are the ones who patch, upgrade, and ship again — faster and stronger.\n\nalso yes, all of this was built and deployed from a **POCO C55 android phone**. constraints breed elegance, bro. 📱\n\nKODA is live, cloud-synced, and bot-proof:\n\n🔗 [https://koda-aicodementor.netlify.app/](https://koda-aicodementor.netlify.app/)\n\nthe dojo is open. the vault is locked. the chats follow you forever.\n\nsee you on the leaderboard 🥋", "url": "https://wpnews.pro/news/our-api-key-got-stolen-by-bots-so-we-rebuilt-the-whole-backend-in-48-hours-and", "canonical_source": "https://dev.to/koda2026/our-api-key-got-stolen-by-bots-so-we-rebuilt-the-whole-backend-in-48-hours-and-now-my-chats-3l7f", "published_at": "2026-09-25 10:44:38+00:00", "updated_at": "2026-09-25 11:01:05.697833+00:00", "lang": "en", "topics": ["ai-tools", "ai-products", "ai-agents", "ai-infrastructure", "developer-tools"], "entities": ["KODA", "Cloudflare Workers", "Supabase", "Netlify", "POCO C55"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/our-api-key-got-stolen-by-bots-so-we-rebuilt-the-whole-backend-in-48-hours-and", "markdown": "https://wpnews.pro/news/our-api-key-got-stolen-by-bots-so-we-rebuilt-the-whole-backend-in-48-hours-and.md", "text": "https://wpnews.pro/news/our-api-key-got-stolen-by-bots-so-we-rebuilt-the-whole-backend-in-48-hours-and.txt", "jsonld": "https://wpnews.pro/news/our-api-key-got-stolen-by-bots-so-we-rebuilt-the-whole-backend-in-48-hours-and.jsonld"}}