Fix guides
Every credential KeyDrift detects, crossed with the tool that put it in your bundle. Each guide explains why that tool produces the leak and gives the exact change that moves the call back to a server.
Lovable
Lovable builds a Vite single-page app with no server of its own. When you ask it to call an API that needs a key, the only place it can put that key is the browser — so it adds a `VITE_`-prefixed variable, and Vite substitutes the literal value into the bundle at build time.