# our API key got stolen by bots so we rebuilt the whole backend in 48 hours 😭🔒 (and now my chats follow me everywhere)

> Source: <https://dev.to/koda2026/our-api-key-got-stolen-by-bots-so-we-rebuilt-the-whole-backend-in-48-hours-and-now-my-chats-3l7f>
> Published: 2026-09-25 10:44:38+00:00

okay so real talk.

last week our AI mentor KODA had its API key sitting in the frontend code. 

and the internet did what the internet does: **bots found it and drained our credits overnight.** 💀

we didn't cry. we didn't quit. we rebuilt the entire infrastructure in 48 hours from a $150 android phone. here's the story, no corporate speak, we promise.

our key was naked in the JavaScript. anyone could right-click → inspect → steal. 

and they did. credits: gone. dreams: temporarily paused.

lesson learned the hard way: **never trust the client. ever.**

we moved the key into a **Cloudflare Worker** (basically a tiny server that lives in the cloud and costs $0). 

now the flow is:

your browser never sees the key again. the bots are officially locked out. cry about it 🤡

**bonus flex:** if one AI model dies or rate-limits, the Worker automatically hops to the next model in a fallback chain. KODA literally heals itself mid-conversation. self-healing AI on a phone budget. we're so back.

this is the part that broke our brains.

we had two URLs: a temp testing one and the main production one. 

we chatted on the temp URL… then opened the main URL… 

**AND THE EXACT SAME CONVERSATION WAS THERE.** 😭

why? because your chats don't live in your browser anymore. they live in a **cloud database (Supabase)** tied to YOUR account, not to a URL. 

we even watched localStorage get buried next to it. pour one out. 🪦⚰️ (see the tombstone on the cover, we paid our respects)

"but bro, can't people just read everyone's chats from the database?"

nope. we used **Row Level Security (RLS)** — think of it as a bouncer built INSIDE the database. every row checks: *"does this user own this row?"* if not → rejected. even if someone bypasses the whole frontend, postgres itself says **nah bro.** 🚫

we also built referrals directly into the database with **triggers**:

no manual work. no spreadsheets. the database runs the growth engine while we sleep. 😴

we got breached because we rushed. 

we got bulletproof because we refused to stay broken.

every founder will get punched by production eventually. the ones who win are the ones who patch, upgrade, and ship again — faster and stronger.

also yes, all of this was built and deployed from a **POCO C55 android phone**. constraints breed elegance, bro. 📱

KODA is live, cloud-synced, and bot-proof:

🔗 [https://koda-aicodementor.netlify.app/](https://koda-aicodementor.netlify.app/)

the dojo is open. the vault is locked. the chats follow you forever.

see you on the leaderboard 🥋