Admin URL and rest API nonce exposed in html

I see there are a few tickets with a similar problem reported but none discuss the fact that this information is exposed in the html by viewing the page source / using devtools. It seems odd that with admin URL exposure being enough of a concern that there are plugins to change and hide it that you would expose it. Even the renamed URL gets shown in the html. Having a nonce that can be used to hit the URL for a period of time available as well just adds to the concern.

I did check other sites running Newspaper and those sites expose the same information so I have concluded it is not something with my site configuration/conflict despite my undoing a bunch of things to try and make it go away.

The two (modified) scripts that show in the header are:

start script one ->
window.tdb_globals = {“wpRestNonce”:”xx4a55yyy6″,”wpRestUrl”:”https:\/\/www.mysite\/wp-json\/”,”permalinkStructure”:”\/%postname%\/”,”isAjax”:false,”isAdminBarShowing”:false,”autoloadScrollPercent”:50};
<- end script one
start script two ->
window.tdwGlobal = {“adminUrl”:”https:\/\/www.mysite\/wp-admin\/”,”wpRestNonce”:”xx4a55yyy6″,”wpRestUrl”:”https:\/\/www.mysite\/wp-json\/”,”permalinkStructure”:”\/%postname%\/”};
<-end script two

How do I make this go away?

Hi Vlad,

Thank you for the reply. I have an email conversation going on with support on this topic — first attempt to create a ticket on this topic failed. Site is the same domain as my email domain.