Notes on what a public page can leak

Are Your API Keys Exposed? How to Check Your Lovable, Bolt or Cursor App's JavaScript

Anything in your frontend bundle is public. Here's how to check whether your AI-built app leaks a Supabase service_role key, Stripe secret key or OpenAI key, which keys are safe to expose, and how to fix it.