Do Not Put a Backend Secret in the Browser

Anything shipped to JavaScript can be inspected by the user, an extension, injected content, or a compromised browser context. A build-time environment variable does not become secret because its name begins with a special prefix.

Keep long-lived backend credentials on the server. If the browser needs access, issue a short-lived session or capability with an explicit scope, audience, expiry, and revocation story.

Verify the boundary in the built artifact, not just in source. Search the production bundle for the key pattern, then exercise the authenticated request path with the browser credential removed.