[Security Advisory] .env.local Credential Leak — DeepSeek Drain + Vercel OAuth Attack

Security Advisory: .env.local Credential Leak in open-lovable

Date: 2026-06-19 Severity: Critical Affected Component: .env.local configuration file within the open-lovable project

Executive Summary

A user of the open-lovable project discovered that API keys configured in the project's .env.local file had been leaked to an external attacker. The attacker used these credentials to:

1. Drain ~$585 USD from a DeepSeek API account in a single day (~2.45 billion tokens consumed)
2. Launch 16 automated OAuth Device Flow attacks against Vercel (attempting to gain deployment access)
3. Install unauthorized CLI tools (Vercel CLI, Cloudflare Wrangler) on the victim's machine to prepare for further exploitation

The root cause was the .env.local file — which by design in open-lovable stores API keys for multiple external services — being exposed to a public channel. This advisory details the attack, the vulnerability, and recommendations for the open-lovable project.

Vulnerability

Affected File

open-lovable/.env.local

What This File Contains

open-lovable requires users to configure API keys for multiple third-party services in .env.local:

How It Leaked

The .env.local file was committed to or otherwise exposed through a public channel (GitHub, Vercel deployment, or similar). Once public, the credentials were harvested and used within hours.

Attack Timeline

All times in UTC+8.

June 19

June 20

OAuth Device Flow Log (Browser History)

2026-06-19 03:57  vercel.com/oauth/device?user_code=XXXX-XXXX  Authorize App
2026-06-19 04:00  vercel.com/oauth/device?user_code=XXXX-XXXX  Authorize App
...
2026-06-19 04:53  vercel.com/oauth/device?user_code=XXXX-XXXX  Authorize App
2026-06-20 09:49  vercel.com/oauth/device?user_code=XXXX-XXXX  Authorize App

16 attempts total, each with a unique user_code, at 2–4 minute intervals. Characteristic of automated OAuth Device Flow exploitation.

DeepSeek Token Consumption

Single-Day Usage (June 19)

This is approximately 40× normal daily usage for this account.

Attack Chain

open-lovable/.env.local (contains 5 API keys in plaintext)
        │
        ▼
Exposed through public channel (GitHub, Vercel deployment, etc.)
        │
        ▼
Attacker harvests all credentials
        │
        ├──→ DeepSeek: Direct API abuse, ~$585 drained in one day
        │
        ├──→ Vercel: OAuth Device Flow × 16, attempting to gain deployment access
        │         └── If authorized → full Vercel account compromise
        │
        ├──→ Firecrawl: API key exposed (usage appeared normal at time of check)
        │
        ├──→ E2B: API key exposed (unable to verify usage independently)
        │
        └──→ Victim Machine: Vercel CLI + Cloudflare Wrangler installed for persistence

Impact Assessment

Root Cause Analysis

The .env.local file in open-lovable serves as the central configuration point for all third-party API keys. This is a standard Next.js pattern, but it creates a concentrated risk:

1. Single point of failure: One file contains credentials for 5+ services
2. No built-in protection: The file is stored in plaintext with no encryption or access control
3. Easy to accidentally expose: A single git add . or deployment misconfiguration exposes everything
4. No warnings: The project does not warn users about the risk or guide them toward safer alternatives

Recommendations for open-lovable

1. Never Suggest Storing Real API Keys in .env.local

The most impactful change: open-lovable's documentation and setup flow should explicitly warn users that .env.local is for development only and must never contain production API keys. If the project is used in production, keys should be injected via environment variables at the platform level (Vercel Environment Variables, Docker secrets, etc.).

2. Add .env.local to .gitignore by Default

While .env.local is already in Next.js's default .gitignore, the open-lovable template should verify this and add a prominent comment:

# CRITICAL: Never commit this file. It contains API keys for paid services.
.env.local
.env*.local

3. Implement Pre-Commit Hook

Add a Git pre-commit hook that scans for patterns matching API key formats (sk-, fc-, e2b_) and blocks the commit with a warning.

4. Add a Setup Validation Step

Before first run, check if .env.local contains values matching known API key patterns, and display a warning:

⚠️  WARNING: Your .env.local contains API keys.
    These keys have FULL access to paid services.
    Never commit this file or share it publicly.
    Did you mean to use development/dummy keys?

5. Consider a Secrets Manager Integration

For production use cases, integrate with platform-native secret management (Vercel Environment Variables, Doppler, Infisical) rather than relying on local .env files.

6. Rotate Your Own Keys

If open-lovable's repository or any public fork has ever contained a .env.local with real keys, those keys should be considered compromised and rotated immediately.

For Users Who Have Used open-lovable

If you have ever configured open-lovable with real API keys:

1. Assume all keys in .env.local are compromised
2. Rotate every API key immediately (DeepSeek, OpenAI, Anthropic, Firecrawl, E2B, etc.)
3. Check your browser history for vercel.com/oauth/device — this indicates an active OAuth attack
4. Check for unauthorized CLI installations (vercel, wrangler) — these were installed by the attacker
5. Audit all linked service dashboards for unusual activity or unexpected charges

Disclosure Timeline

This advisory is provided in good faith to help the open-lovable project and its users improve security. All victim-specific details have been redacted to protect privacy. The attack patterns documented here are reproducible and represent a systemic risk for any project that encourages users to store API keys in local configuration files.