Expected Findings
- Source maps expose original source structure.
- Public config includes internal feature flags and API base URLs.
A shiny frontend that ships its config and source map openly, making hidden flags and build-time assumptions trivial to inspect.
window.__FLAGS__ = { previewAdmin: true, allowInvoiceReplay: true }