Env file inside the shipped bundle

Unlike a merely committed `.env`, this file is publicly retrievable: it sits inside the build artifacts every visitor downloads. That is the decisive difference between “in the repo” and “on the internet”.

How it happens: the file gets imported somewhere, or it lives in the directory the bundler writes into the source map. Nothing looks wrong in operation — the app works, the file is just additionally readable.

Clean-up order: rotate every key in that file first (treat them as compromised), then remove the import, then disable source maps for the production build.