Search GitHub for "API keys" plaintext is:issue sometime. You will find maintainers of real, deployed, multi-user apps writing sentences like "keys are currently stored in plaintext in the database, this is a liability for the platform." I have read dozens of these issues in the last month, because I have been emailing the people who write them.
The demand side is easy to explain. Users ask for BYOK (bring your own key) because they already pay for AI somewhere else, because they want their prompts running on their own provider account, or because your free tier's rate limits annoy them. Developers want BYOK because inference costs scale with usage and revenue does not.
So BYOK keeps getting requested, and it keeps getting implemented badly. Here are the four levels I keep seeing in the wild, ranked from worst to production-grade.
Level 0: plaintext column in the database
This is more common than anyone wants to admit. A users.openai_api_key column, written on save, read on every request.
