Comparison
Build targetvsClient-side secret
Build target
you narrowed the supported browser list and the output shrank without you deleting any code.
The declared set of browsers a build must run in, which drives how much transpilation and how many polyfills are included. It is usually inherited from a template and never revisited, which is how projects end up shipping generator helpers to browsers that have had async functions for years. Widening it is a size decision, not a compatibility formality.
Full entry →Client-side secret
the API key is in the bundle, which means it is in everyone's browser and in their devtools.
Any credential shipped to the browser, which is by definition public no matter what the environment variable was called. Build-time inlining makes this easy to do by accident, because the variable looks like a server-side one right up until it is bundled. The only real fixes are keys scoped to be safe in public with origin restrictions, or a server-side proxy that holds the real credential.
Full entry →