Integration Rule

Never expose private API keys in frontend code. Payment, email, webhook, and provider-secret logic must stay server-side.