Server secret in client JavaScript

Why it matters

Anything in your JavaScript bundle is public. A secret key there lets anyone spend your money or read your data as you.

How to fix it

Move the key to a server-only environment variable (never NEXT_PUBLIC_ / VITE_), call the provider from a server route, then rotate the key.

How we test it

Passive — runs in the free check, looks only at what a browser can see.