Source code
Security & compliance
Releases
Secret-shaped NEXT_PUBLIC_ env var (A02)
Part of the AI-generated code risks check · fix arrives as a guide
What it is
An environment variable behind a client-bundle prefix (NEXT_PUBLIC_, VITE_, REACT_APP_, PUBLIC_) holds a value that looks like a secret.
Why it matters
OWASP A02. These prefixes instruct the bundler to inline the value into the JavaScript every visitor downloads. There is no exploit and no permission check to fail — the value is simply published when the build runs.
How to fix it
Move the value to a server-only variable and reach it through an API route or server action. Then rotate it, because any build that already shipped has published it.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.