diff --git a/.gitignore b/.gitignore
index fa4d28d..2c71b17 100644
--- a/.gitignore
+++ b/.gitignore
@@ -91,3 +91,6 @@ keystore.properties
 
 # Cloudflare Wrangler
 .wrangler
+
+# Local build secrets (Giphy etc.) — injected via --dart-define-from-file
+dart_defines.json
diff --git a/dart_defines.example.json b/dart_defines.example.json
new file mode 100644
index 0000000..5cb1dc2
--- /dev/null
+++ b/dart_defines.example.json
@@ -0,0 +1,3 @@
+{
+  "GIPHY_API_KEY": "your-giphy-api-key-from-developers.giphy.com"
+}
diff --git a/lib/widgets/gif_picker.dart b/lib/widgets/gif_picker.dart
index 9c56951..7cd335e 100644
--- a/lib/widgets/gif_picker.dart
+++ b/lib/widgets/gif_picker.dart
@@ -19,9 +19,11 @@ class _GifPickerState extends State<GifPicker> {
   bool _isLoading = false;
   String? _error;
 
-  // Giphy API key - Using public beta key (limited usage)
-  // For production, replace with your own Giphy API key from developers.giphy.com
-  static const String _giphyApiKey = 'sXpGFDGZs0Dv1mmNFvYaGUvYwKX0PWIh';
+  // Giphy API key — injected at build time, never hardcoded. Provide it via:
+  //   flutter build ... --dart-define-from-file=dart_defines.json
+  // (or --dart-define=GIPHY_API_KEY=<key>). Empty when unset → the picker shows a hint.
+  static const String _giphyApiKey =
+      String.fromEnvironment('GIPHY_API_KEY');
 
   @override
   void initState() {
@@ -36,6 +38,11 @@ class _GifPickerState extends State<GifPicker> {
   }
 
   Future<void> _loadTrendingGifs() async {
+    if (_giphyApiKey.isEmpty) {
+      setState(() => _error =
+          'GIF picker needs a Giphy API key (build with --dart-define=GIPHY_API_KEY=<key>).');
+      return;
+    }
     setState(() {
       _isLoading = true;
       _error = null;