The one file you must never commit — and the trap that ships secrets to the browserUpdated Oct 27, 2026