Secret-named value behind a client-bundle prefix

What it is

A variable whose name indicates a secret — containing SECRET, PRIVATE, TOKEN, or PASSWORD — carries a client-bundle prefix.

Why it matters

The prefix publishes the value into the browser bundle at build time. The name says it was not meant to be public, and the build does not check intent.

How to fix it

Move the value to a server-only variable and reach it through a route handler or server action, then rotate it — any build that shipped has already published it.