.envDrop dist/, or a .zip of it
Each of these would have matched so much ordinary code that the real findings would be buried. Nothing here is hidden from you, and you can override any of it.
Sourcemaps are decoded with a first-party ECMA-426 VLQ decoder rather than a library, because both obvious candidates were measured and both are disqualifying here: one silently promotes malformed segments into a fabricated source location, the other crashes outright on an out-of-range index. Archives are read and written with fflate.
For secrets and personal data inside a dataset rather than a build, use scrubjay. To take a JSON Web Token apart properly, use tokenpeek.
Built by Ben Richardson. More tools and sites at lab.benrichardson.dev. Source at github.com/ben-gy/leakmap.