Why client-side environment variables are a bad idea

Would gamersafer be liable for the AWS bill if someone malicious found that key?