React SPA Security & GitHub Pages Deployment

[uyriq]

This post concerns a React Single Page Application deployed to GitHub Pages using:

• React 18
• GitHub Actions for CI/CD
• GITHUB_TOKEN with 'no permissions' for authorize access to https://models.inference.ai.azure.com

Security: Environment Variables in React SPA

Current Setup

// filepath: .env
REACT_APP_OPENAI_API_KEY=mykey        // ❌ Exposed in bundle
REACT_APP_GITHUB_TOKEN=GITHUB_TOKEN    // ⚠️ Limited exposure risk

is this true or false?

what can be done bad with GITHUB_TOKEN from react bundle?

Comment below with specific use cases or security concerns!