I've been doing this to access variables passed to the EJS template via Express's res.render:

router.route("/build")
.get([isLoggedIn, finishedRegistration], function(req, res){
    res.render("build", {loggedInUser: req.loggedInUser});
})

And then utilizing them on the client side within script tags as needed:

<script>
    var user = <%- JSON.stringify(loggedInUser) %>
  //do something with stringified variable
  //do another thing with it
</script>

This solution is given in many Stackoverflow questions, and it works fine, but if you peek at the source code in the browser...

<script>

    var user = {"tokens":-3,"_id":"615c62ba5d2315162893a4ac","username":"dev","email":"shg.webdev... (and so on)

Oops, everybody and their dog can see the data being stringified. This seems vulnerable to me. Is there an alternative way that doesn't expose data like that? Or, can I hide the stringified data from being seen in the source?