A declaration marked @secret is reachable from a @wire type or an
@action browser contract. Shipping it would place a private value in a
generated declaration, codec, request, response, or browser bundle.
Keep the value on the server and expose only the smallest explicitly public scalar the browser needs:
@wire
struct PublicConfig {
api_origin: str,
}Public client environment values are declared separately under
[client.env]. Verniz never copies the process environment or a private server
environment table into that module.
Removing @secret only to silence the diagnostic is unsafe. Cut the
reachability chain, derive a public value, or move the operation behind an
@action that does not return the secret.
See also: TE763 and the Verniz Sites bridge specification.