Environment Variables You're Leaking to the...

You added NEXT_PUBLIC_ to your API key "just to test something quickly". That was six months ago. It's still there. Most developers know the rule: secret keys go in .env, never in client code. But the actual leaks aren't that obvious. They don't happen because someone is careless — they happen because the tooling is confusing, the error messages are silent, and the mistakes look completely fine until someone opens DevTools or pulls your bundle. Mistake 1 — The NEXT_PUBLIC_ prefix on secrets Next