Secrets and config
Private value under a public environment prefix
A variable named with the framework's public prefix is inlined into the client, even though its value should have stayed private.
Termsclient bundle (the JavaScript your app sends to the browser or ships inside the mobile app; anyone can read it) · publishable and secret keys (the publishable key may sit in the browser because row-level security limits it; the secret key bypasses those rules and must stay on the server) · security headers (HTTP response headers (HSTS, content-type, frame policy) that switch on the browser's built-in protections) · CI (the pipeline that builds and tests every change before it can be merged or deployed)
highseverity if found in a releasesources verified 2026-09-21
Why AI-assisted code produces it
Frameworks expose any variable carrying the public prefix; Next.js documents that NEXT_PUBLIC_ variables are sent to the client. Generated code copies the prefix from a neighbouring variable without checking what the value can do.
An exported Server Action is reachable by direct POST request even when not used in the UI; a page-level authentication check does not extend to the Server Actions defined within it; environment variables prefixed NEXT_PUBLIC_ are exposed to the client.
Source: Next.js docs, 2026-08-25 · verified 2026-09-21
How we detect it
List every client-prefixed variable and check what each value can read or write against the provider.
Most associated with
Tools: Cursor, GitHub Copilot, Claude Code, Windsurf, Lovable, Bolt
Checklist items that catch it
Public environment prefix carries only public values
manual List every variable with a client-exposed prefix (NEXT_PUBLIC_, EXPO_PUBLIC_, VITE_, REACT_APP_) and confirm each one is meant to be public.
Every client-prefixed variable is documented as public; no variable holds a key that can write or read beyond the anonymous role.
Dots: Starter, Growth, Scale. The item runs on every release for the plans marked.
More in secrets and config
- critical
- critical
- critical
- high
- medium
Check your codebase for this pattern
The coverage audit lists which catalogue patterns apply to your critical flows. 5 business days, $1,200, credited to a first month.