According to the article, they were keeping their environment variables in React's local state. To anyone that works with React professionally, or even on the side, this is so baffling that a team would do this.

I'm honestly wondering who they hired for the job. Because this is one of the most fundamental failings in security I've ever seen.