Client-side model calls with exposed provider key

Why it matters

Your browser code talks to an AI provider directly with your key. Anyone can copy it and run up your bill.

How to fix it

Proxy AI calls through a server route that checks the user and rate-limits, then rotate the key.

How we test it

Passive — runs in the free check, looks only at what a browser can see.