Frontend & browser·Browser security
the API key is in the bundle, which means it is in everyone's browser and in their devtools.
Client-side secret
Also calledexposed API key, secret in the bundle
Any credential shipped to the browser, which is by definition public no matter what the environment variable was called. Build-time inlining makes this easy to do by accident, because the variable looks like a server-side one right up until it is bundled. The only real fixes are keys scoped to be safe in public with origin restrictions, or a server-side proxy that holds the real credential.