“this was. horrifying, it was the entire process.env of a heroku instance, in the JS.”
portfolio.a16z.com shipped its whole Heroku environment inside its front-end JavaScript. AWS keys, the database URL, and Salesforce, Okta and Mailgun credentials sat in the browser’s sources tab, and they were real. a16z paid no bounty because the researcher went public. She went public because the only security address she could find bounced her emails.