VITE_ and NEXT_PUBLIC_ variables are public

By Shinobi Tech, the team behind AppLeakWatch. Updated .

Environment variables starting with VITE_, NEXT_PUBLIC_ or REACT_APP_ are copied into your browser code when the app is built. Putting one in a .env file doesn't keep it secret. Anyone can read it in your site's JavaScript.

Why this happens

AI tools often add these prefixes to make an error go away. The feature starts working, and your secret quietly ships to every visitor.

How to check

  1. List the public variables in your project:
    grep -rE "(VITE_|NEXT_PUBLIC_|REACT_APP_)[A-Z_]*(KEY|SECRET|TOKEN|PASSWORD)" .
  2. Decide for each one: would you be happy posting this value online?
  3. Search your build output for a real value:
    grep -r "PART_OF_YOUR_KEY" dist/ .next/static/

How to fix it

  1. Remove the public prefix from anything secret.
  2. Replace any value that has already been deployed.
  3. Call the service from a server route or function instead.
  4. Keep public prefixes for values that are safe to share, such as a Supabase anon key or a Stripe publishable key.

Prompt for your AI tool

List every VITE_, NEXT_PUBLIC_ and REACT_APP_ variable in this project and say whether each is safe to be public. Move anything secret into server code without the public prefix, and tell me which keys I need to replace.

Review what your AI tool changes, and test the live site afterward.

Catch this before a stranger does

AppLeakWatch keeps checking your live app and emails you when something new appears.

Start your 7-day trial

Common questions

Does hiding the code help?

No. Minified code is still readable, and keys are easy to find.

What belongs in a public variable?

Only values you'd be comfortable showing to anyone, like your site's address or a publishable key.

Related guides