If you do conditional imports, the code is not executed but it is still shipped to the client.
Didn’t think of it before but if you put the secret code in a “server” folder it won’t be shipped to the client. I didn’t realize “server” folders are honored as server-only in the new “/imports” folder, but they are.
In all the confusion, the correct way is:
- Put all secret code in “server” folders. The folders can be located anywhere in the dir tree.
- Use
if (Meteor.isServer) {import...}to import the modules (the app will anyways not compile if you don’t, since the client would try to import a module that does not exist.