It's simply software engineering malpractice to have ever sent any of those keys to the client. There is no excuse. It is a well-solved problem to handle secr

It's simply software engineering malpractice to have ever sent any of those keys to the client. There is no excuse. It is a well-solved problem to handle secrets; there are better and worse solutions. An environment variable for a server can get exposed if the server is hacked; a secret sent to a client is exposed the second the server goes live. One of these is much worse than the other. There are also better solutions than environment variables. A competent team would be aware of many options. Whoever coded this is not competent, full stop. It's not that they didn't finish; these services should never have accessed from the client at all.