Security

What if an API key appears in browser code?

First determine whether the provider explicitly designates the key as public. A VITE_ prefix only changes visibility. If a secret was exposed, treat it as compromised and revoke or rotate it through the provider before repairing the code. Deleting the current line does not remove copies from deployed bundles or version history.

1. 1Move the secret-dependent action to a server-side handler.
2. 2Authenticate the caller, validate input and limit what the handler can do.
3. 3Check built browser assets and error logs for accidental exposure without copying secrets into reports.

Does hiding a Pro button protect paid content?

No. If the answer or paid lesson is already in downloaded JavaScript, hiding it on screen does not prevent retrieval. A protected server read must check current entitlement before returning content. Similarly, an account should not gain access to another user's record simply by changing an identifier in a request. Test these denial paths in isolation.