“Wait hang on if everyone’s vibe coding I bet they’re accidentally leaking soooooo many API keys like, publicly. And they don’t even know”, is what I thought one day. “But *how* bad is it?” I had to know, so I tried scanning newly registered domain names every day. This talk is the story of how I found myself drowning in poor vibe coders’ diverse selection of API keys, and, um, how anyone could 😳. I tried to measure how easy it was to find actual, valid API keys on new, presumably vibe coded websites. I have, in my travels, calculated various numbers, such as the average time it takes for a valid API key to be leaked after a domain is registered. There will be a thrilling analysis of today’s results, so please nobody vibe code too hard the day before.