Secrets in a build that has no server

Every framework has a prefix that means "put this in the browser bundle": PUBLIC_, NEXT_PUBLIC_, VITE_. Renaming a variable is enough to publish a credential.

Three habits

1. Use the narrowest scope that can build the site.
2. Keep write-capable keys off CI entirely. Seed from a laptop.
3. Grep the build output for the key before trusting the setup.

The third one takes five seconds and replaces an assumption with a fact.