AccessToken in bundle

in the article Add a headless CMS to Gatsby.js in 5 minutes - Storyblok you advocate to use this code for adding storyblok js client:

import config from '../../gatsby-config'
const sbConfig = config.plugins.find((item) => item.resolve === 'gatsby-source-storyblok')
const Storyblok = new StoryblokClient({
  accessToken: sbConfig.options.accessToken,
  cache: {
    clear: "auto",
    type: "memory",

If I am reading this correctly, by importing gatsby-config, all access tokens there from environment will be exposed in the bundle. Is this correct?

As a next question, how can I use storyblok js client without exposing my secret access key in the bundle?