School · Module 1 · Lesson 2 of 4
No secret keys in the browser bundle
Anything prefixed NEXT_PUBLIC_ or VITE_ is shipped to every visitor.
Client bundles are public. A secret in a NEXT_PUBLIC_ or VITE_ variable, or hardcoded in a file under app/ or src/, can be read from View Source or the Network tab.
Put secret keys only in server code: Route Handlers, Server Actions, API routes, Edge/Node functions. The browser may hold publishable keys (pk_, sb_publishable_ or the legacy anon key) but never sk_, service_role or webhook secrets.
Scan the built output before you ship. ShipSafe's homepage scanner and tools like gitleaks catch common patterns.