A browser must receive the JavaScript it runs. Any credential embedded in that bundle can be inspected by the visitor, so a private server key does not become safe just because it was stored in an environment file.
Separate public configuration from secrets
- Use client-exposed environment prefixes only for values designed to be public.
- Call private services from a server-side route that checks authorization and limits the operation.
- Inspect generated bundles and deployment logs for accidental secret values before release.
Contain an exposed credential
If a secret reaches a client bundle or repository, revoke or rotate it at the provider, inspect its use, and remove it from the active build. Deleting a line from the latest commit does not erase the credential from prior history or deployed assets.
A public browser key may still need domain restrictions, quotas, or narrowly scoped permissions. Those controls reduce abuse; they do not make a public value confidential.