I wouldn't be surprised if there's a significant number of small or large deployments out there that use a nodejs build such as webpack, that has pulled in some

I wouldn't be surprised if there's a significant number of small or large deployments out there that use a nodejs build such as webpack, that has pulled in some kind of JSON configuration file with prod keys exposed hidden in those huge bundles.