- Home
- The 17 checks
- A server secret has a browser-visible name
A server secret has a browser-visible name
In plain English: Some setting names start with a word like NEXT_PUBLIC_ or VITE_, which tells your build tool to copy the value into the website every visitor downloads. A secret with one of those names is public, even if it looks hidden.
What happens if you ship it
Your build tool copies it into the JavaScript every visitor downloads, where anyone can read it.
How to fix it technical
Let your AI tool fix it
Paste this into Lovable, Bolt, Cursor, Replit or Claude Code:
Fix this problem in my project: A server secret has a browser-visible name. Rename this variable without the public prefix, and move the call that needs it into a server route or edge function. Change only what this fix needs, then tell me what you changed and anything I have to do myself.Check your app
Run npx sigship in your project folder. It reports this problem as public-env-secret, along with 16 other checks. Nothing leaves your computer. New to the terminal?
Questions
Which prefixes make a variable public?
Common ones are NEXT_PUBLIC_ in Next.js, VITE_ in Vite, PUBLIC_ in SvelteKit and Astro, REACT_APP_ in Create React App, and EXPO_PUBLIC_ in Expo. Only values that are safe for anyone to see should use them.
Is the Supabase anon key safe to make public?
It is designed to be public, but only if row level security is on for every table. Your service role key must never be public.