The exact mechanism that ships secret keys to the browser in AI-built apps, and the 5-minute grep that catches it before launch.