Real find in a website's javascript

What an absolutely shitty peppering string.

The code file has 32.171 lines, at least after beautifing it. 1MB fucking js code.
- And this is why I hate all web development and the fact that most jobs are web bs these days. Everything has so much crud baked in and including twelve modules with a million functions just to do anything is the norm.
  
  Giving my back my beautiful optimized assembly dangit.
- Don't worry, this file is likely the output of a bundler.

It's an internal inside of React.

https://github.com/facebook/prop-types/blob/4de0644a10a554d0a556daa39f029369bc007ea5/lib%2FReactPropTypesSecret.js#L10

Crazy what other commenters are coming up with.
So using react will get you fired? I knew it!

What am I looking at here?

There's a string stating that the code should not be passed or the employee will be fired. I'd assume this was a test to see if an employee meant to be doing code review was actually doing them. Spoiler, they were not, as OP said they found this in production code.
- I'd go a step further and I suspect it's a peppering string (i.e. fixed string you add to hashes to defeat rainbow tables). I'd really hope it isn't as you mentioned because gosh that sounds like a toxic workplace if someone is just leaving landmines around purely to get someone fired.
My guess is a "solution" to the age-old problem of needing to store a secret in a file that the user can download, thus making the entire system insecure.

This "solution" appears to be either that the string itself is so outrageous that the user would not believe that it's the real secret when it is in fact the real secret, leveraging security through obscurity, or else it's there in place of the real secret that cannot be revealed under pain of ~~death~~ firing, and therefore is accidentally being used instead of that intended secret... so it's not secret after all.

Unless they're doing something incredibly clever to substitute that secret string for the real thing when the time is right and doing it in such a way that the user can't intercept, someone's getting fired.
- No, it's not. It's part of React internals that you shouldn't use because your app will break. It's a warning for developers using React. It's not a secret of any kind.

I bet the guy who said "looks good to me" still has a job too.

You should really be using a pre commit hook to catch secrets. Admittedly it may not have caught this, but manual review is (clearly) not always sufficient.

it's part of react proptypes: https://github.com/facebook/prop-types/blob/4de0644a10a554d0a556daa39f029369bc007ea5/lib/ReactPropTypesSecret.js#L10