I Don't Want Your API Key. Here's Why BYOK Matters.
BYOK means you keep control of your AI provider keys. Here's how it works, why it's more private, and how to set it up in VibeShield in under a minute.
A few weeks after we launched VibeShield, someone DMed me: "How do I know you're not logging my code when I use the AI fix suggestions?"
Fair question. The answer is: you don't have to trust us. Because we never see your code.
Here's why that's true, and why we built it that way from day one.
The Privacy Problem Nobody Talks About
When you use an AI feature through a SaaS platform, there are usually three parties in the room: you, the platform, and the AI provider. The platform sits in the middle. They see your prompts. They see the AI responses. They might log them for "quality improvement." They might train on them. They might store them in a database that gets breached two years later.
I've been on the other side of that. I've worked at companies where engineers could query the prompt logs and read what users were asking. Most of the time it was innocent debugging — "why did this request fail?" But the point is: they could. And you had no way to know.
With BYOK, the platform drops out of the loop. Your prompt goes directly from your browser to the AI provider using your key. The platform never touches it.
What BYOK Actually Means
BYOK stands for Bring Your Own Key. You create an API key from an AI provider — OpenAI, Anthropic, Google, or any provider accessible through OpenRouter — and paste it into VibeShield. When you click "Get AI Fix Suggestions," the request goes directly from your browser to the AI provider using your key.
You pay the AI provider directly at their standard rates. No markup. No middleman. And critically, VibeShield never receives, stores, or relays your key. It stays in your browser's localStorage.
The Comparison
| BYOK | Server-Side AI | No AI | |
|---|---|---|---|
| Who pays? | You (direct to provider) | Vendor (marks up to you) | Nobody |
| Key location | Browser localStorage only | Vendor's servers | N/A |
| Privacy | Provider sees requests; platform doesn't | Platform sees everything | N/A |
| Cost per request | ~$0.002–0.01 | $20–50/month subscription | Free |
| Setup time | 30 seconds | Instant (billed later) | Instant |
| Provider choice | 500+ models via OpenRouter | Whatever the vendor picked | N/A |
Figure 1: BYOK compared to server-side AI and no-AI approaches across cost, privacy, and flexibility dimensions.
The trade-off is real. BYOK means you manage your own key and pay per request. Server-side AI means less setup but less privacy and a monthly subscription. Neither is wrong — they serve different priorities.
For VibeShield, we chose BYOK because our core promise is "scan your app without exposing anything." That promise doesn't work if we're logging your scan results through a third-party AI API.
Common Concerns (Answered Honestly)
"Does the free scanner still work without a key?"
Yes. The scanner runs entirely client-side. It finds exposed secrets, missing headers, cookie issues, and injection vectors without touching any AI provider. The AI fix suggestions are optional — they analyze your findings and generate code fixes, but the scanner itself is completely standalone.
"What if I lose my key or it gets compromised?"
Your key lives in your browser's localStorage. If you clear your browser data, you'll need to paste it again. If you suspect your key was compromised, rotate it from your AI provider's dashboard — VibeShield never had it, so there's nothing to revoke on our side.
"Can I use a free-tier key?"
Yes. OpenRouter offers free models like Gemini Flash and Llama that work with BYOK. You don't need to spend anything to get AI fix suggestions.
"What happens if my key runs out of credits?"
The request will fail with a billing error from the AI provider. VibeShield will show you the error so you know what happened. Top up your credits and try again.
How to Set It Up
-
Go to openrouter.ai/keys and create an API key. OpenRouter gives you access to 60+ providers and 500+ models through a single key.
-
In VibeShield, open Settings. Paste your key into the BYOK field. It's stored only in your browser — we never see it.
-
Run a scan. When the results come back, click "Get AI Fix Suggestions." Your browser sends the finding directly to OpenRouter using your key. OpenRouter routes it to the model you selected. The response comes back with a copy-paste code fix.
That's it. No account creation. No credit card on our side. No monthly commitment. You control your keys, your data, and your costs.
We built it this way because it's the right thing to do. Not because it's easier — it's actually harder to build a good UX around BYOK than around server-side AI. But the trust math is simple: if you don't have to trust us with your code, you shouldn't have to.
Summary
- BYOK (Bring Your Own Key) means your AI provider keys stay in your browser's
localStorage— VibeShield never receives, stores, or relays them. Your prompts go directly from your browser to the AI provider. - You pay AI providers directly at their standard rates with no markup. OpenRouter gives you access to 500+ models through a single key, including free-tier models like Gemini Flash and Llama.
- The free scanner works completely without any AI key — it finds exposed secrets, missing headers, cookie issues, and injection vectors on its own. AI fix suggestions are strictly optional.
- Setup takes 30 seconds: create a key at openrouter.ai/keys, paste it into VibeShield Settings, and you're done. No account creation, no credit card on our side, no monthly commitment.
Found this useful? Try it at vibeshield.org — free scan, BYOK is optional. The scanner works without any key.
Read next: I Shipped an AI App in 4 Hours. Then I Found My Stripe Key in the Browser for what the scanner finds. Or We Built a Security Scanner in a Weekend for the engineering behind it.