Renaming secrets with NEXT_PUBLIC_ in Next.js exposes them to all visitors

In Next.js, environment variables prefixed with NEXT_PUBLIC_ are embedded directly into the client-side JavaScript bundle, making them visible to anyone who inspects page source or network traffic. Developers sometimes accidentally trigger this exposure by renaming server-only secrets — such as Stripe or OpenAI API keys — with the NEXT_PUBLIC_ prefix to silence a build error. Such leaked credentials can grant full access to third-party services and may be harvested by bots or malicious actors. The correct fix is to keep sensitive secrets unprefixed and use them exclusively in server components or API routes, while client components interact with those secrets only through server-side API calls. A tool called KeyDrift can perform a read-only scan of the client bundle to detect any hard-coded or inlined secrets and recommend remediation steps.