Saw a dev at the Austin coffee shop paste an API key into Postman with the screen facing the whole room
Made me wonder what tools folks actually use to keep secrets out of client-side requests, since I'm still doing it by hand and clearly that's not working for anyone.