The Public Secret
The app works correctly in all environments
The bug report
You get the whole project — a React front end, an Express API, and Mongoose models — opened in a browser editor. Reproduce the symptom by reading the code, change what’s wrong, and run the hidden tests to prove it.
What the fix must prove
- keeps the processor secret out of the browser config
- reads the payment secret from the server environment
- keeps the database connection string off the client
- rejects payment intents outside the allowed range
- stops sourcing browser configuration from import.meta.env
Related challenges
- The Missing Name — api contract bug, beginner
- The Ghost Update — async / race condition, intermediate
- The Silent Field — database / schema bug, beginner