https://blog.lynxflow.co/en/tags/key-management/Recent content in Key Management on Lynx Tech BlogHugo -- gohugo.ioenWed, 02 Sep 2026 01:00:00 +0800https://blog.lynxflow.co/en/posts/frontend-secret-leakage-ai-era/Wed, 02 Sep 2026 01:00:00 +0800https://blog.lynxflow.co/en/posts/frontend-secret-leakage-ai-era/<img src="https://blog.lynxflow.co/images/frontend-secret-leakage-ai-era.png" alt="Featured image of post What the Server Knows, the Browser Shouldn't Get: Mapping the Frontend Secret-Leakage Surface" />Let’s start with a scenario. You’re building a SaaS product: the backend is connected to a cloud database, the frontend is Next.js, and iteration is moving fast. Before launch, you ask the security team to run a black-box test. On the third day, the report comes back with two high-severity findings: C1: On the homepage, “View Source” reveals that the JSON inside __NEXT_DATA__ contains the full backend configuration that should have existed only on the server side—database address, message queue