Detect environment variables and secrets reaching the client bundle via loader
return values, hydration state, or server-only modules imported from client code
paths.
Use for "audit secrets", "find leaked env vars", "is my API key exposed", "scan
for credential leaks".
