Vercel
Security & compliance
Releases
Code quality
Public env exposure
Secrets inlined into the browser bundle at build time.
Overview
Prefixes like NEXT_PUBLIC_, VITE_, REACT_APP_, and PUBLIC_ tell your bundler to inline the value into client JavaScript. lumioguard reads every variable behind one of those prefixes and grades it on whether the value looks like a credential.
What it looks for
- Live provider secret keys behind a client-bundle prefix
- Secret-named values behind a client prefix
- Ambiguous key or credential names inlined into the bundle
- autoExposeSystemEnvs pushing system variables into every build
- Production secrets older than a year with no rotation
Why it matters
There is no exploit here and no permission check to fail: the value is in the JavaScript every visitor downloads. A live Stripe secret key behind NEXT_PUBLIC_ is published the moment the build finishes, and rotating it is the only fix.
Rules in this check
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.