Resend API key (re_...) leaked: stop the spam before reputation tanks

1. Step 01

   Open Resend Dashboard → API Keys → revoke the leaked key.

2. Step 02

   Create a new key, update server env, redeploy.

3. Step 03

   Check Resend → Emails for unfamiliar sends. If found, contact Resend support to flag the abuse window.

Step 01 — Revoke

Kill the leaked credential first

API Keys → click the leaked key → Revoke. Confirm. Then "Create API Key" with role "Sending access" (lower blast radius than "Full access").

Step 02 — Rotate

Update the new key in the right place

Server-side env vars only — never in client code, never with NEXT_PUBLIC_.

import { Resend } from 'resend';
// Server only — never NEXT_PUBLIC_RESEND_API_KEY.
const resend = new Resend(process.env.RESEND_API_KEY);

Step 03 — Scan

Confirm nothing else leaked alongside it

Scan to find SMTP, mail, or other transactional secrets in your bundle.

How this usually leaks

• 01Used in a client component for a "contact us" form.
• 02.env committed to GitHub.
• 03Embedded in serverless function logs that are publicly retrievable.