Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variables

What it is

Any NEXT_PUBLIC_ variable is inlined at build time by design. A common quick fix, renaming a secret with the prefix so a client component can read it, publishes the secret.

In the 30,998-app scan, 1,332 apps had something key-shaped in their JavaScript; 52 were dangerous keys such as OpenAI, AWS, Anthropic, a Stripe secret key or a Supabase service_role. Escape’s report also cites a write-up showing API keys routinely leaked in Lovable deployments.

How to check

1. grep your env files and code for NEXT_PUBLIC_ / VITE_ variables holding words like SECRET, KEY, TOKEN.
2. Search the deployed bundle for prefixes like sk_live_, sk-, AKIA.

How to fix

1. Rotate any exposed key at the provider first.
2. Call the third-party API from a server route / Edge Function and keep the key server-side.

# Find suspicious public env vars in your repo
grep -rnE "(NEXT_PUBLIC|VITE)_[A-Z_]*(SECRET|KEY|TOKEN)" --include=*.{js,ts,tsx,env} .

# Search a downloaded production bundle for common secret prefixes
grep -oE "(sk_live_[A-Za-z0-9]+|sk-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})" dist/**/*.js

Sources

• KeyDrift: Supabase JWT exposed in a Next.js app ↗
• r/vibecoding: 30,998-app scan ↗
• Escape: State of Security of Vibe Coded Apps 2025 (PDF) ↗