Modern sites pull in JavaScript and config bundles. Developers love leaving "temporary" credentials, TODOs, and keys in those files — and every one ships straight to the browser.
This demo portal loads its settings from a config bundle. The portal works fine — but a careless developer left something in that file they shouldn't have.
Two ways in: open app.config.js ↗ directly and read it, or open DevTools → Network (or Sources) tab, reload, and inspect the loaded scripts.
Why it matters: secret-scanning your repos and bundles is now standard practice. Real keys belong in server-side env vars or a vault — never in anything the browser downloads.