Close to 12,000 valid secrets that include API keys and passwords have been found ... mistake was to hardcode them into HTML forms and JavaScript snippets and did not use server-side environment ...