Build-time secrets are still secrets Marco Lind February 20, 2026 A static site has no server to leak from, which makes it easy to forget the build had credentials. security ci