FrontendHaltSecurity·Intermediate·Conceptual·1 min read
Can a frontend safely contain a secret API key?
Short interview answer
No. Anything delivered to the browser can be inspected or invoked by the user or malicious code. Public identifiers may live in the client, but secret-backed operations require a trusted server that enforces authentication, authorization, quotas, and allowed parameters.
Key takeaway
Explain the underlying mental model clearly, then support it with a concrete example and its trade-offs.