Blog

What your build actually ships

Writing from KeyDrift on client-side secret exposure, build-time environment variables, and the difference between a key that leaked and one that belongs there.

20 August 2026
Your .env file is not the problem
Git-ignoring your environment file protects the repository, not the bundle. Here is what actually ends up in the JavaScript you serve.
secretsbundles4 min read

What your build actually ships

Your .env file is not the problem