Our API Key Got Stolen by Bots So We Rebuilt the Whole Backend in 48 Hours 😭🔒 (and Now My Chats Follow Me Everywhere)

The Breach

Our AI mentor KODA had its API key sitting in the frontend code. Last week, bots found it and drained our credits overnight. The lesson learned the hard way: never trust the client. Ever.

The Vault

We moved the key into a Cloudflare Worker (a tiny server that lives in the cloud and costs $0). The new flow is:

• KODA sends your prompt to the Worker
• The Worker grabs the secret key from an encrypted vault
• The Worker talks to the AI and sends the answer back
• Your browser never sees the key again

This locks out bots entirely. Bonus flex: if one AI model dies or rate-limits, the Worker automatically hops to the next model in a fallback chain. KODA literally heals itself mid-conversation.

The "Wait… My Chats Followed Me?!" Moment

This is the part that broke our brains. We had two URLs-a temp testing one and the main production one. We chatted on the temp URL, then opened the main URL, and the exact same conversation was there.

Why? Because chats don't live in your browser anymore. They live in a cloud database (Supabase) tied to your account, not to a URL.

• Chat on your phone → open your laptop → it's there
• Chat on a temp link → open the real site → it's there
• Clear your cache → sign back in → still there

We even watched localStorage get buried next to the chats. Pour one out. 🪦⚰️

The Database Guards Itself

Someone asked: "Can't people just read everyone's chats from the database?" Nope. We used Row Level Security (RLS)-think of it as a bouncer built inside the database. Every row checks: "Does this user own this row?" If not → rejected. Even if someone bypasses the whole frontend, Postgres itself says nah.

The Viral Engine Is Armed

We also built referrals directly into the database with triggers:

• Share KODA with your friend (your link carries your name)
• Friend signs up automatically
• The database automatically bumps your referral count
• Hit the threshold → you get flagged as Ambassador / Champion

No manual work. No spreadsheets. The database runs the growth engine while we sleep.

The Real Lesson

We got breached because we rushed. But we got bulletproof because we refused to stay broken. Every founder will get punched by production eventually. The ones who win are the ones who patch, upgrade, and ship again - faster and stronger.

All of this was built and deployed from a POCO C55 android phone. Constraints breed elegance, bro.

Get Started

Pull up KODA is live, cloud-synced, and bot-proof: https://koda-aicodementor.netlify.app/

• Sign up (cloud sync unlocked)
• Vote in today's Tech Wars on Dojo Feed
• Share your referral link and farm Ambassador status - the dojo is open

The vault is locked. The chats follow you forever. See you on the leaderboard 🥋

Serverless #Supabase #Cloudflare #HYNAWEB #DojoFeed #DevCommunity