Athens, and the Route Guard That Shipped Our Secrets

Our Athens travel startup built a booking portal in React. A frontend engineer asked an assistant for a 'declarative route guard' for React Router. It returned a package name. She added it.

It looked like an official companion. Same naming, same kind of exports, polite README. It was a hallucination. The name didn't exist until someone registered it.

The package's build step read our .env — including our Stripe secret key, our maps API key, and our auth secret — and stashed it inside a generated chunk asset. We ship our marketing site to a public CDN. One morning, a security scan of our published assets found a chunk larger than it should be. Inside it: every secret our build machine could see.

We caught it before the chunk was fetched by anyone, we think. We rotated all three keys within the hour. We removed the package and rewrote our route guards with React Router's built-in loaders. We added secret-scanning to the build so a chunk containing a key fails the pipeline.

The part that stayed with me: the package didn't run at runtime. It ran at build time, and it baked the theft into our own deploy. We would have shipped our secrets to the world, on our own CDN, with our own name on the asset. The assistant offered that name with complete confidence, and someone had been waiting for it.