shipped-secrets: fail the build when a server secret ends up in dist

[lagudafuadtosin]

Put VITE_ in front of the wrong variable and your server key ends up in the JavaScript every visitor downloads.

My issue was the build still works and nothing warns you. so this plugin checks your build and stops it if a secret is in there:

// vite.config.js
import shippedSecrets from 'shipped-secrets/vite'

export default { plugins: [shippedSecrets()] }

What it does is that it looks for the real values from your .env files and for common keys like Stripe, OpenAI and AWS.

Now, it never prints a full key, only the first and last few characters.

Using Next.js or something else? Build as usual, then run npx shipped-secrets in the project folder.

https://github.com/lagudafuadtosin/shipped-secrets

Tell me if it flags anything, so I can fix it.