Reading it wrong. Any application needs to use secrets, it's up to the developer to pass them in properly. For example, you can use environmental variables, command line args when running the process, or a config file. This isn't a client-side library.