Rule 8 of 8 · Chapter III — Publish & Run

Nothing secret ships in the WASM bundle.

Why this rule exists

Every byte of a WASM app is downloaded by the browser and readable by anyone with F12. appsettings.json in wwwroot is not configuration — it is publication.

In practice

Client config carries only public values (API base URLs, feature flags). Secrets live server-side behind an API the client calls. Audit wwwroot in CI for known secret patterns.