This Article is also found in Web-Warrior-Toolbox

Anything you put in the frontend or expose through routes is visible to users and AI agents, while secrets like API keys and credentials must stay server‑side.

In this article I propose organizing your project with clear boundaries to make it obvious what’s safe to expose and what must be hidden, reducing the chance of leaking sensitive data.

I used this folder structure

⋊> ~/projects tree my-project -la 09:36:59