Fix guides
Every credential KeyDrift detects, crossed with the tool that put it in your bundle. Each guide explains why that tool produces the leak and gives the exact change that moves the call back to a server.
Claude Code
A CLI agent working across the repo will follow the pattern it already sees. If one component reads a key from `import.meta.env`, the next feature it writes will too — the leak spreads by imitation rather than by a single mistake.