Level 3
Secret in the browser
The scenario
PetPals sends booking confirmations through an email service.
The API key for that service is sitting in the app's front-end code, where any visitor can read it.
Guided hint · Beginner mode
Try it on your own app: right-click the page and choose View page source. Anything you can read there, a stranger can too. Keys belong in secrets, behind a backend function.