Leaked OpenAI API key — what attackers do and how to rotate

Your OpenAI key was committed to GitHub or shipped in a client bundle. Here is what an attacker can do in the first sixty seconds, how to rotate safely, and how to prevent the next one.