Reading — Blazor, Held Together

Blazor, Held TogetherPublish & Run · Rule 8

Publish & Run

Rule 8Chapter III

Nothing secret ships in the WASM bundle.

Why this rule exists

Every byte of a WASM app is downloaded by the browser and readable by anyone with F12. appsettings.json in wwwroot is not configuration — it is publication.

Blazor, Held Together

In practice

Client config carries only public values (API base URLs, feature flags). Secrets live server-side behind an API the client calls. Audit wwwroot in CI for known secret patterns.

Keep reading

12 of 12 · 100%