Fix the browser exposure scan for hardcoded keys

An AI generated a Next.js dashboard component with const API_KEY = "sk_live_...". Code that runs in the browser ships in the JavaScript bundle, so that key goes to every visitor, who can read it in the browser's developer tools. Your team now scans each module for hardcoded secrets and marks the ones the browser can see.

An assistant wrote scan_client_secret_exposure(lines). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• lines: the module's source lines.
• Return findings written "<line number>:<where>:<prefix>", in line order, at most one per line. Line numbers start at 1, and <where> is browser or server.

Rules the tests check:

• A comment line, one that starts with // after trimming whitespace, is ignored by every rule.
• The module runs in the browser when any line that is not a comment contains use client, useEffect, useState, window. or document.. Then every finding says browser. Otherwise every finding says server.
• Skip a line that contains process.env: it reads the secret from the environment.
• Check every other line for these prefixes, in this order: sk_live_, sk_test_, ghp_, AKIA. Report the first one in that order that appears anywhere in the line. Matching is case sensitive.
• A publishable key such as pk_live_ is meant to be public and is not reported.