[Security Advisory] .env.local Credential Leak — DeepSeek Drain + Vercel OAuth Attack

# Security Advisory: `.env.local` Credential Leak in open-lovable

> **Date**: 2026-06-19
> **Severity**: 🔴 Critical
> **Affected Component**: `.env.local` configuration file within the open-lovable project

---

## Executive Summary

A user of the open-lovable project discovered that API keys configured in the project's `.env.local` file had been leaked to an external attacker. The attacker used these credentials to:

1. **Drain ~$585 USD** from a DeepSeek API account in a single day (~2.45 billion tokens consumed)
2. **Launch 16 automated OAuth Device Flow attacks** against Vercel (attempting to gain deployment access)
3. **Install unauthorized CLI tools** (Vercel CLI, Cloudflare Wrangler) on the victim's machine to prepare for further exploitation

The root cause was the `.env.local` file — which by design in open-lovable stores API keys for multiple external services — being exposed to a public channel. This advisory details the attack, the vulnerability, and recommendations for the open-lovable project.

---

## Vulnerability

### Affected File

```
open-lovable/.env.local
```

### What This File Contains

open-lovable requires users to configure API keys for multiple third-party services in `.env.local`:

| Environment Variable | Service | Risk if Exposed |
|----------------------|---------|-----------------|
| `OPENAI_API_KEY` | DeepSeek (OpenAI-compatible) | API bill drained, model abuse |
| `ANTHROPIC_API_KEY` | DeepSeek (Anthropic-compatible) | Same as above |
| `FIRECRAWL_API_KEY` | Firecrawl (web scraping) | Scraping credit abuse |
| `E2B_API_KEY` | E2B (code sandbox) | Unauthorized sandbox execution |
| `SANDBOX_PROVIDER` | Configuration directive | Reveals infrastructure choices |

### How It Leaked

The `.env.local` file was committed to or otherwise exposed through a public channel (GitHub, Vercel deployment, or similar). Once public, the credentials were harvested and used within hours.

---

## Attack Timeline

All times in UTC+8.

### June 19

| Time | Event |
|------|-------|
| ~03:57 | First Vercel OAuth Device Flow authorization page auto-opened in browser |
| ~04:04 | Attacker installed `vercel` CLI on victim machine |
| ~04:56 | Attacker installed `wrangler` (Cloudflare Workers) CLI on victim machine |
| 03:57–04:53 | 15 consecutive OAuth Device Flow attempts (one every 2–4 minutes) |
| 03:27–19:42 | DeepSeek API abused — ~943 successful API calls before balance exhaustion |
| 19:42 | DeepSeek returns 402 Payment Required — balance fully drained |
| **Full day** | **2.45 billion tokens consumed, ~$585 USD total loss** |

### June 20

| Time | Event |
|------|-------|
| ~09:49 | 16th Vercel OAuth Device Flow attempt — attack still active >24 hours later |

### OAuth Device Flow Log (Browser History)

```
2026-06-19 03:57 vercel.com/oauth/device?user_code=XXXX-XXXX Authorize App
2026-06-19 04:00 vercel.com/oauth/device?user_code=XXXX-XXXX Authorize App
...
2026-06-19 04:53 vercel.com/oauth/device?user_code=XXXX-XXXX Authorize App
2026-06-20 09:49 vercel.com/oauth/device?user_code=XXXX-XXXX Authorize App
```

16 attempts total, each with a unique `user_code`, at 2–4 minute intervals. Characteristic of automated OAuth Device Flow exploitation.

---

## DeepSeek Token Consumption

### Single-Day Usage (June 19)

| Category | Tokens | Cost (USD) |
|----------|--------|:----------:|
| Input (Cache Hit) | 1,225,422,426 | $4.44 |
| Input (Cache Miss) | 1,117,301,120 | $486.03 |
| Output | 108,121,306 | $94.07 |
| **Total** | **2,450,844,852** | **$584.54** |

This is approximately **40× normal daily usage** for this account.

---

## Attack Chain

```
open-lovable/.env.local (contains 5 API keys in plaintext)
│
▼
Exposed through public channel (GitHub, Vercel deployment, etc.)
│
▼
Attacker harvests all credentials
│
├──→ DeepSeek: Direct API abuse, ~$585 drained in one day
│
├──→ Vercel: OAuth Device Flow × 16, attempting to gain deployment access
│ └── If authorized → full Vercel account compromise
│
├──→ Firecrawl: API key exposed (usage appeared normal at time of check)
│
├──→ E2B: API key exposed (unable to verify usage independently)
│
└──→ Victim Machine: Vercel CLI + Cloudflare Wrangler installed for persistence
```

---

## Impact Assessment

| Service | Impact | Status at Disclosure |
|---------|--------|---------------------|
| DeepSeek | $585 drained, 2.45B tokens consumed | Keys rotated, attacker blocked |
| Vercel | 16 OAuth attempts, no authorization confirmed | Account under review |
| Firecrawl | Key exposed, credits normal | Rotation pending |
| E2B | Key exposed | Rotation pending |
| Victim Machine | Unauthorized CLI tools installed | Removed |

---

## Root Cause Analysis

The `.env.local` file in open-lovable serves as the central configuration point for all third-party API keys. This is a standard Next.js pattern, but it creates a concentrated risk:

1. **Single point of failure**: One file contains credentials for 5+ services
2. **No built-in protection**: The file is stored in plaintext with no encryption or access control
3. **Easy to accidentally expose**: A single `git add .` or deployment misconfiguration exposes everything
4. **No warnings**: The project does not warn users about the risk or guide them toward safer alternatives

---

## Recommendations for open-lovable

### 1. Never Suggest Storing Real API Keys in `.env.local`

The most impactful change: **open-lovable's documentation and setup flow should explicitly warn users that `.env.local` is for development only and must never contain production API keys.** If the project is used in production, keys should be injected via environment variables at the platform level (Vercel Environment Variables, Docker secrets, etc.).

### 2. Add `.env.local` to `.gitignore` by Default

While `.env.local` is already in Next.js's default `.gitignore`, the open-lovable template should verify this and add a prominent comment:

```gitignore
# CRITICAL: Never commit this file. It contains API keys for paid services.
.env.local
.env*.local
```

### 3. Implement Pre-Commit Hook

Add a Git pre-commit hook that scans for patterns matching API key formats (`sk-`, `fc-`, `e2b_`) and blocks the commit with a warning.

### 4. Add a Setup Validation Step

Before first run, check if `.env.local` contains values matching known API key patterns, and display a warning:

```
⚠️ WARNING: Your .env.local contains API keys.
These keys have FULL access to paid services.
Never commit this file or share it publicly.
Did you mean to use development/dummy keys?
```

### 5. Consider a Secrets Manager Integration

For production use cases, integrate with platform-native secret management (Vercel Environment Variables, Doppler, Infisical) rather than relying on local `.env` files.

### 6. Rotate Your Own Keys

If open-lovable's repository or any public fork has ever contained a `.env.local` with real keys, those keys should be considered compromised and rotated immediately.

---

## For Users Who Have Used open-lovable

If you have ever configured open-lovable with real API keys:

1. **Assume all keys in `.env.local` are compromised**
2. **Rotate every API key immediately** (DeepSeek, OpenAI, Anthropic, Firecrawl, E2B, etc.)
3. **Check your browser history** for `vercel.com/oauth/device` — this indicates an active OAuth attack
4. **Check for unauthorized CLI installations** (`vercel`, `wrangler`) — these were installed by the attacker
5. **Audit all linked service dashboards** for unusual activity or unexpected charges

---

## Disclosure Timeline

| Date | Event |
|------|-------|
| 2026-06-19 | Attack occurs; victim observes abnormal API usage and unauthorized browser pages |
| 2026-06-20 | Full forensic analysis completed; attack chain traced to open-lovable `.env.local` |
| 2026-06-20 | This advisory prepared for responsible disclosure to open-lovable maintainers |

---

*This advisory is provided in good faith to help the open-lovable project and its users improve security. All victim-specific details have been redacted to protect privacy. The attack patterns documented here are reproducible and represent a systemic risk for any project that encourages users to store API keys in local configuration files.*

Start by inspecting the repository’s .gitignore, .env.local setup guidance, and first-run flow. The issue bundles several possible changes, including credential warnings, secret scanning, and production-secret guidance, so identify the maintainers’ chosen scope before editing. Done should include a clearly defined protection or warning and verification that real keys are not encouraged or committed.

Written by the indexing model from the issue text.