Inurl View Viewshtml ((full)) -

—identifying exposed devices so they can be secured, not for voyeurism. How to Protect Yourself

If you must store views in the web root, block direct access: inurl view viewshtml

In a properly rendered page, env.STRIPE_SECRET_KEY would be replaced with the actual key. In the raw views.html , the server-side variable is exposed. —identifying exposed devices so they can be secured,