Searching the built bundle rather than the source is the right call, since env variables prefixed for the client get inlined at build time and are easy to miss in code review. Adding a CI step that greps the output folder for common key patterns like sk_live or service_role turns this into a check nobody has to remember. And rotating the key comes before removing it from the code, because the old bundle can stay cached on a CDN for a long time.