I Built My Own Config Format for Node.js That Separates Server and Client Secrets

The problem with dotenv that nobody talks about, and how I fixed it with kq-config. The Problem Every Node.js project I've worked on has the same setup: DB_PASS = supersecret SECRET_KEY = myjwtsecret API_URL = http://localhost:3000 THEME = dark PORT = 3000 One .env file. Everything in one place. Server secrets, client settings, database passwords, all mixed together. This works fine until we think: who can see what? Your frontend code runs process.env.API_URL , works fine. But what stops it from