A developer uses Vite's 'import.meta.env.VITE_API_KEY' to inject an API key into a frontend Vue application. A security engineer raises a concern. Why?

• A.Vite hashes the VITE_ value with SHA-256 before bundling it into the output file leaving the key unreadable to people who open the page source in a browser tab or in the network inspector of the developer tools
• B.The VITE_ prefix keeps the value on the build server while the Vue application reads it through an authenticated endpoint at startup. The browser receives a session token for that endpoint instead of the key itself
• C.Any variable prefixed with 'VITE_' is intentionally bundled into the client-side JavaScript by Vite - anyone who downloads the JS bundle or inspects the page source can read the API key value
• D.Vite loads the VITE_ variables from the browser storage at runtime instead of the build output. A visitor can edit that storage to point the application at a different key value that the visitor controls