Astro renders on the server or at build time, so secrets are safe in frontmatter and server endpoints, but PUBLIC_ variables and anything passed to hydrated islands reach the browser. Use astro:env secret fields and avoid set:html on untrusted content.
Exposed to client scripts and islands.
Readable only in server code.
Use context server and access secret so the build rejects client imports.
Endpoints that read secrets per request must run on the server, not at build time.
Island props are serialized into HTML, so never pass secrets or private fields.
Astro does not escape set:html, which enables XSS.
Script tags run in the browser and expose any key they use.
Static Astro sites can call RealComposer edge URLs at build time or from small islands, keeping upstream secrets in the vault instead of the deploy environment.
Yes. Frontmatter runs on the server or at build time and is not sent to the browser, unless you render or pass the value.
Static sites have no server to hold RESEND_API_KEY. RealComposer provides a zero-maintenance edge proxy that receives form submissions from your static HTML site and sends emails via Resend with sub-50ms latency.
Static HTML / Astro apps hit CORS and credential limits when calling Zendesk. POST pipeline creates Zendesk requests with vault token. Use one RealComposer edge URL with OPTIONS handling, client tokens, and vault injection.
Cloudinary payloads are heavy for Static HTML / Astro. Admin list endpoints mapped to thumbnail-focused schema. RealComposer output mapping returns only the fields your UI needs at the edge.
Jamstack is a web architecture where sites are prebuilt into static files served from a CDN, with dynamic functionality provided by JavaScript calling APIs at runtime. It delivers fast, secure pages because there is no origin server rendering each request.
Edge FunctionsEdge functions are serverless code that executes in data centers distributed worldwide, physically close to end users, rather than in one central cloud region. They intercept HTTP requests to run logic like authentication, routing, caching, and response transformation with minimal latency.
Credential LeakageCredential leakage is the unintended exposure of secrets such as API keys, tokens, and passwords. Common sources include JavaScript bundles, decompiled mobile apps, public Git repositories, browser network logs, and low-code platform configurations visible to users.