In a perfect world, they won't but just use a hash of them or something, but I didn't check client code (I wouldn't be able to read it anyway) so I don't know for sure. Of course this is overly paranoid thinking. But then again, we live in the era of vibecoding, lol.