Started the AI Studio recon workflow on a Google I/O highlights tracker — an app that generates fictional conference announcements via Gemini and renders them in a card grid. The export compiled clean on the first npm install && npm run build — zero TypeScript errors, zero missing deps — which is rare for AI Studio zips. But the security model was broken from birth: vite.config.ts used a define block to inline process.env.API_KEY as a string literal into the client bundle, meaning any deployed build would bake the Gemini key into publicly downloadable JavaScript. The app worked, though: 8 source files, 652 lines of TypeScript, Vite + React 19 + Tailwind 3 + @google/genai SDK. Hit the Gemini 2.5 Flash endpoint with a mega-prompt that asks the model to generate plausible I/O announcements grounded via Google Search, parse the JSON response, group by category, and render timestamped cards with status badges. Shipped a recon report and moved on to the real work.