What if my Stripe or Supabase keys are leaked in the bundle?

We rotate every key inside the first 48 hours of engagement — Stripe, Supabase, OpenAI, anything we find. We assume the old values are in someone's Docker cache, browser bundle, or git history. Rotation is non-negotiable. We also flip any NEXTPUBLIC*_SECRET style variables to server-side only and audit the bundle to confirm secrets are out of the client.