View source, find the token, get nothing

A bug-bounty hunter opens your SaaS, reads the JS bundle, and finds container-saas-prod sitting next to the AI endpoint. They file a critical: exposed AI credential.

You close it as informational. The request that token belongs to is made inside your container, to the Hoody AI gateway running on the same server. The gateway ignores the string and checks which container the request came from. Pasted into curl on the hunter's laptop, the token fails before a model is ever selected.

This is the scenario that normally forces a proxy layer, a secrets vault, and a rotation runbook: all to keep one string out of a bundle. Here the string can sit in the bundle.

A leaked credential is only a leak if it works somewhere else.