What problem does it solve? Grepping frontend JavaScript bundles for secret-looking variable names produces many false positives, because bundlers only inline environment variables that match a specific prefix. This Skill triages whether a matched assignment actually leaked a real value into the shipped bundle, and identifies systemic root causes across multiple hosts. ## Core Features & Use Cases - Bundler prefix rules: Applies the exposure rules for Next.js (NEXT_PUBLIC_), Vite (VITE_), Create React App (REACT_APP_), Nx, and Webpack to determine if a variable can reach the client bundle. - Literal-value confirmation: Verifies leaks by searching the compiled bundle for the actual secret literal rather than trusting declarations like process.env.SECRET. - Systemic root-cause analysis: Detects when a shared internal SDK mandates a config key, so one platform-level report replaces many duplicate single-host reports. - Use Case: After a source-map sweep surfaces process.env.API_SECRET across 30 apps, use this Skill to confirm which apps ship real values, then file one report describing the shared SDK defect with all affected hosts. ## Quick Start Triage whether the secret-looking environment variable assignments found in this JavaScript bundle actually leaked real values to the browser.
