Lite is free. Pro adds this and the rest of the quality layer.
You leakedan API key.
Removing the key from the file is not the fix. Here is the right order, and how to stop it happening again.
Lite and Pro
// the problem
What goes wrong
Deleting the line does not delete the keyGit keeps history. The key sits in an old commit, and any copy of the repository, fork or cache still has it.
Bots find it fastPublic repositories are scanned for keys all the time. Treat a pushed key as used the moment it is visible.
// what adams does
What Adams does
Blocks it before the commitLite: the secret guards stop a key at commit and move it to an ignored env file, so it never enters history.
Gives you the orderPro: hey adams offers to move the key out of code, check if it went public, replace the old key, then test a payment.
Checks historyPro: the secure check on secrets and dependencies looks for keys in old commits and tracked env files.
// worked example
An example
The order of the fix
From a real hey adams run on a test store.
~/project~/your-project · example
A key looks pasted into app/api/checkout/route.ts
1. Move the key out of code (recommended)
2. Check if it went public
3. Replace the old key
4. Test a payment
// faq
Questions
Should I replace the key or clean history first?
Replace the key first. History cleaning takes time and copies may exist. A replaced key is useless to anyone who found it.
Is the key safe if the repository is private?
Less exposed, not safe. Anyone with access, and every tool that clones it, can read it. Replace it if the key is sensitive.
What is free?
The guards that stop a key at commit.
// related