RepliedDay 16 · 11:12
Please tell me we’re not putting the API key in the share URL
Build the share URL from an explicit allowlist of public fields. Keep the key out of query strings, analytics events and saved public results. Don’t serialize the whole form state.