Are VITE_ and NEXT_PUBLIC_ env variables public? Yes.

Any env var prefixed VITE_, NEXT_PUBLIC_, or REACT_APP_ is compiled into your JavaScript bundle. What belongs there and what doesn't.

Short answer: yes. Build tools replace import.meta.env.VITE_* (Vite), process.env.NEXT_PUBLIC_* (Next.js) and process.env.REACT_APP_* (Create React App) with their literal values at build time. The value ends up in the JS file every visitor downloads. The prefix exists precisely to mark a variable as safe to expose.

Fine to expose

• Supabase URL and anon / publishable key (only safe with RLS on; see anon key explained)
• Firebase web config
• Stripe publishable key (pk_…)
• Public analytics IDs

Never prefix these

• OpenAI / Anthropic / other model keys (sk-…)
• Stripe secret or restricted keys (sk_live_…, rk_live_…) and webhook secrets
• Supabase service_role / secret key
• Database connection strings, SMTP/Resend/SendGrid keys

How to check your live site

Open DevTools → Sources (or Network → JS files) and search for sk-, sk_live, service_role, postgres://. Anything found is public already: move the call to a server route or edge function, then rotate the key. Removing it from the code does not un-leak it.

List every environment variable this app reads. For each one with a VITE_, NEXT_PUBLIC_ or REACT_APP_ prefix, tell me whether it is safe to be public. Move any secret ones into a server route or edge function, call that from the frontend instead, and tell me which keys I must rotate.

Related: Hide API keys · Leaked OpenAI key

Update (Oct 2026): EXPO_PUBLIC_ works the same way, and ShipLatch now flags secret-looking values in any public env var. Read the update →

Want the whole pre-launch process in one place? Get App Security for Vibe Coders, our $9 PDF playbook.

More guides

• Is my Lovable app secure?
• How to enable Supabase Row Level Security (RLS)
• Exposed Supabase service_role key: what to do now
• Lovable security checklist