Leaked Gemini Specific Key: what to do in the first hour

• Environment files committed by accident. A .env file with the key next to other settings, pushed because the file was never listed in .gitignore.
• Notebooks and demos. A key pasted into a Colab or Jupyter cell to try a prompt, then saved with the notebook when it was shared.
• Browser code. A web page or mobile app that calls the Gemini API directly, so the key ships to every visitor. Calls should go through your own backend.
• Sample code. A tutorial or example project with the key filled in, copied into a repository that later became public.
• Logs and screenshots. A debug print of the request configuration, or a screenshot of a settings page, posted in an issue or a chat.

1. Create a replacement key first in Google AI Studio, on the API keys page. Give it a name that says where it is used, and keep it in your secret manager or environment settings.
2. Deploy the new key and confirm that production still works. Keep one key per application so the next rotation is smaller.
3. Delete the exposed key on the same page. Deleting is what ends the exposure, and calls with the old value fail from then on.
4. Check usage in Google Cloud. Gemini keys are tied to a project, so open the project that owns the key and look at the metrics and quota pages for the Generative Language API. Look for a spike since the exposure, calls from regions you do not serve, and models you never use.
5. Check billing. Review the charges for the project and set a budget alert that reaches a mailbox someone reads. A budget does not stop usage on its own, so treat it as a warning, not a fix.
6. Review other keys in the project. Look for other API keys and service accounts you cannot account for, and delete any without a clear owner.
7. Clean the repository. Remove the value from the files, then check the history. A commit that once held the key still contains it, so rotation is the real fix. See I accidentally pushed an API key to GitHub.

Not sure what else leaked? Run a free scan.

Gemini API keys are managed on the API keys page of Google AI Studio. Sign in with the Google account that created the key, find the key in the list, and delete it. If the key does not appear, it may belong to a different Google account or a different project, so check the project selector before you give up. A key that was created in Google Cloud may be listed under the Cloud project’s credentials instead of AI Studio, so look in both places. The labels on these pages change from time to time, so follow the on-screen wording rather than a remembered menu path.

The rule is called “Gemini Specific Key”. It is a contextual rule. It looks for a label word such as gemini, google_ai, ai_studio, palm, api_key, or simply key, optionally followed by more letters, then a colon or an equals sign, then a value in one of the two formats above. The label may be in any letter case, and the value is reported on its own, without the label. Because key is a common word, the rule accepts some unrelated names, which is a deliberate trade-off to catch names such as geminiKey. The severity is high, with the impact class for software-as-a-service access. This type is checked live: LeakWatch can check whether a detected key is still active with a read-only request that lists the Gemini models available to it. It never sends a prompt and never reads your content.