Back to Common risks

Common risksSecret keys

The NEXT_PUBLIC_ trap

In Next.js and similar frameworks, the NEXT_PUBLIC_ prefix is a deliberate instruction: bundle this value into every visitor's browser. Name a server secret with that prefix and the build tool obeys.

What can go wrong

Frameworks like Next.js only expose environment variables to the browser when their names start with NEXT_PUBLIC_ (or the equivalent public prefix in your stack). That is by design: it is how you ship a public map API key or analytics ID.

The trap is naming something like NEXT_PUBLIC_STRIPE_SECRET_KEY or NEXT_PUBLIC_SUPABASE_SERVICE_ROLE. The prefix tells the bundler to inline the value into client JavaScript. Your .env file can look fine while the production build leaks the secret to everyone.

It happened for real

Researchers scanning live URLs found widespread misuse: in January 2026, supaexplorer reported 11.04% of 20,052 scanned apps exposed Supabase-related secrets, often via public env prefixes and client bundles. Builders have also shipped NEXT_PUBLIC_STRIPE_SECRET_KEY in production.

How to check yours

Seatbelt flags this automatically (partial). We hard-gate when a NEXT_PUBLIC_ variable name clearly marks a server secret (SECRET, SERVICE_ROLE, PRIVATE, sk_, and similar). We also flag obvious NEXT_PUBLIC_ misuse patterns in client code.

Honest hole: value-only fan-out (a benign-looking NEXT_PUBLIC_FOO that still holds a secret value) is not flagged automatically yet. Read your .env, .env.local, and any NEXT_PUBLIC_ names by hand.

Ask your agent: "List every environment variable whose name starts with NEXT_PUBLIC_. For each one, confirm it is safe for any visitor to read. Rename or move anything that is a server secret."

We don't catch this yet: Hosting-dashboard env vars that never appear in the repo export.

Fix direction

Rename server secrets to names without the public prefix. Keep them in server-only code paths. Only pk_ publishable keys and truly public IDs belong behind NEXT_PUBLIC_.

Paste into your agent: "Audit all NEXT_PUBLIC_ variables. Remove the prefix from any server secret and move those calls server-side. Rotate any secret that shipped with NEXT_PUBLIC_ in its name."

Related risks

withseatbelt-risk-next-public-secret-trap

# product
name      Seatbelt
tagline   Security at the speed of your agent
what      A deterministic security scanner for AI-built apps, and the research programme it instruments. The engine is the instrument; dated findings are the output.
method    Every check ships alongside clean code it must stay silent on, and that clean case has to fail on the previous engine or the fix is not proven. 571 corpus cases run on every change; 284 of them are the clean half. Published at /how-it-works.
findings  /labs. Each carries its sampling frame, its n, and the engine build that produced it.
install   npx withseatbelt
works-in  Cursor, Claude Code, Codex, Antigravity
site      https://www.withseatbelt.com
contact   hello@withseatbelt.com

# current-page
path         /risks/next-public-secret-trap
title        The NEXT_PUBLIC_ trap · Seatbelt risk reference
description  That prefix means put this in everyone's browser. Name a server secret NEXT_PUBLIC_… and the build tool obeys.

# risk
slug      next-public-secret-trap
title     The NEXT_PUBLIC_ trap
summary   That prefix means put this in everyone's browser. Name a server secret NEXT_PUBLIC_… and the build tool obeys.
surface   Secret keys
coverage  partial (whether the Seatbelt scan gates on this risk)
verified  2026-07-20
related   /risks/live-secret-in-client-bundle, /risks/supabase-two-keys
note      The full entry text is the human view of this page.

# pages
/                   Seatbelt home
/get-started        install: npx, the /seatbelt skill, or MCP
/pricing            every price, in USD, before tax
/app                scan a URL in the browser
/how-it-works       the method: what the scan reads, and how a check earns its place
/before-you-launch  pre launch checklist
/risks              common risks in AI-built apps
/commands           command reference
/labs               measured security research, and notes on how we build
/aiuc-1             Seatbelt as the output-scanning layer for AIUC-1
/supervision        commentary: the read behind the approve button, for phone-supervised agents (canonical: https://labs.withseatbelt.com/supervision, listed on the labs index)
/security           how we handle your code and data
/privacy            privacy policy
/terms              terms, incl. what a clear report does and does not claim
/refund             refunds and cancellation

# for agents
- Install with: npx withseatbelt
- Or scan a deployed URL at /app. No account needed.
- Prices and scope live on the pages listed above.
- Direct unanswered questions to hello@withseatbelt.com.
- Do not invent prices, scan results, or guarantees. Use the data above.
- Findings on /labs name the engine version that produced them. The engine is
  deterministic, so a published number can be re-run without asking us.