I'm about to launch an app I built with an AI coding tool. I want to check for exposed credentials: API keys, database credentials and service tokens that ended up in the client bundle, the repo, or the repo history.

List every API key, token and secret this app uses, and say exactly where each one lives: in the client bundle, in an env file, or in the repo. Which of those can a visitor see?

A good answer is a short list, each key named and placed, for example "Supabase service role key, in the client bundle, visible to anyone", with the ones that are exposed called out, and a fix for each: move it server-side, rotate it, restrict it.