VITE_DEV_USER (.env.local = louis@targo.ca) was inlined by Vite into auth.js's localhost fallback, shipping personal PII in every prod build. Gate that branch behind import.meta.env.DEV so esbuild dead-code-eliminates it (and the inlined string) from production builds — permanent, no reliance on a build flag. Also neutralize the two hardcoded louis@targo.ca in the campaign TemplateEditor (merge-tag sample → exemple@gigafibre.ca; test-send default → empty, send button already guards on non-empty). Leak-check clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| client | ||
| field-tech | ||
| ops | ||
| portal | ||
| website | ||