Most frontend apps are leaking their “secret” API keys… and don’t even know it 🚨 It usually starts with good intentions: 🔹 move keys to .env ✅ 🔹 add .gitignore ✅ 🔹 avoid hardcoding ✅ Feels like you’ve handled security. But here’s the reality 👇 In setups like Next.js, anything meant for the browser (like NEXT_PUBLIC_*) ends up inside your app during build time. So when your app runs: 📦 the key is inside your JS bundle 🔍 visible in DevTools ⚡ extractable The rule is simple: 👉 If it runs in the browser, it’s not a secret. What actually works 🛠️ 🔒 keep API keys on the server 🔁 call third-party APIs from backend 📤 send only required data to frontend (API routes, server actions, BFF => pick your style) Frontend can’t protect secrets. Your Architecture does. #Frontend #JavaScript #WebSecurity #ReactJS #CareerGrowth #WebDev #TechCareers
It's actually good that Nextjs enforces the NEXT_PUBLIC_ prefix for env variables that will leak into the browser. The name is an additional security guard, a reminder whether you really want this value to be available in the JS code executed to the browser. Vite does it with VITE_ prefix for the variable name, but it's doesn't highlight the security awareness in comparison to Nextjs' prefix.
"Frontend can't protect secrets. Your architecture does." This should be pinned in every dev onboarding doc haha The NEXT_PUBLIC_ prefix trips up so many devs, myself included early on. Once you internalize that the browser is always a public environment, the BFF pattern just clicks. Next.js Server Actions make this so clean now API keys never leave the server.
Is this problem with next js or any other framework like Vue js Or angular
use something like https://env.t3.gg/docs/introduction