Secrets in NEXT_PUBLIC_ and VITE_ variables

NEXT_PUBLIC_, VITE_, PUBLIC_, EXPO_PUBLIC_ and REACT_APP_ are instructions to your bundler: inline this value into the browser build. They exist so you can publish things deliberately.

A variable named NEXT_PUBLIC_STRIPE_SECRET_KEY is therefore wrong regardless of what is in it. Even if it is empty today, the wiring publishes whatever lands there next.

Rename the variable to drop the public prefix, move the code that uses it to a server route, and delete every client-side reference. Then rotate the credential — if a real value was ever in that variable, it shipped.

A server-side variable is any name without one of those prefixes. There is no additional setting to change.

A Supabase anon key, a Stripe publishable key, a Clerk publishable key, a PostHog project key, a reCAPTCHA site key. These are designed to be published and we do not flag them.