LLM Model Theft

Description

Detects vulnerabilities that could lead to model theft or API key exposure. OWASP LLM10 - Model Theft. Model theft can occur through: - API key exposure in client-side code or logs - Model weights exposed via insecure endpoints - Model extraction attacks via unrestricted API access - Insecure model serialization and storage - Missing access controls on model endpoints This rule detects: - Hardcoded API keys in source code - API keys in client-side JavaScript - Model files served without authentication - Missing rate limiting on inference endpoints - Model parameters logged or exposed

What Shoulder detects

Model theft vulnerability: {issue_type}

How to fix

Load API keys from environment variables and proxy LLM calls through your server.

```javascript
const openai = new OpenAI({
  apiKey: process.env.OPENAI_API_KEY
});
```

Learn more: https://shoulder.dev/learn/javascript/cwe-200/llm-model-theft

Applies to

Languages

🟨 JavaScript 🔷 TypeScript

Frameworks

nodejs express

References

Documentation ↗ OWASP ↗ Learn about CWE-200

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=javascript-llm-model-theft .