I already shared code with a key in it. What now?

Treat the key as leaked: revoke or rotate it in the service it belongs to (Stripe, OpenAI, Supabase and so on) right away, then remove it from the code. Deleting the file is not enough if anyone already downloaded it.

Which license should I choose?

MIT if you want buyers to use the code freely, including commercially. A commercial license if buyers may use it in their own projects but not resell the kit. GPL or AGPL if anything built on it must stay open source.

Selling code safely: secrets, licenses and honesty

By Vibe Codes · Updated October 13, 2026

The most common way people get hurt selling code is not a bad buyer. It is a live API key left in a file that every buyer receives. Here is what to check before you sell anything you built with AI.

Remove every secret

.env files of any name, and anything that looks like sk_live_…, sk-…, AKIA…, ghp_…, private keys, or database addresses with passwords in them.
Keys hard-coded in source files, config files, comments, notebooks and old test scripts — AI tools often paste them where they were convenient.
Service account files (service-account.json, .pem, .p12).

Replace each one with a placeholder and list them in a .env.example file with one line saying what each is for. If any key was ever in shared code, rotate it.

Remove private data

Real customer records, email lists, database dumps, logs and screenshots that show real people's information do not belong in a package. Use made-up sample data instead.

Check what you have the right to sell

Your own code is yours to license. But fonts, icons, photos and libraries the AI pulled in come with their own licenses, and some forbid resale. Replace anything you are not sure about, and choose a license for your code so buyers know what they may do with it.

Do not ship anything harmful

Read what you include. Remove code you do not understand that contacts other servers, runs commands at install time, or is obfuscated. A buyer trusts that your kit does what it says and nothing else.

Describe it honestly

List what works, what does not, what you never tested, what outside services it needs, and what data it collects. Honesty is not just ethics here: it is what makes a stranger willing to pay.

How Vibe Codes helps

The listing prompt has your own AI do all of the above and write the report, and every upload is scanned again for leaked keys, unsafe file paths and malicious code before it is accepted — anything found is reported back with the file and line, and nothing is published. Read more in how to sell a vibe coded app.