The one file you must never commit — and the trap that ships secrets to the browser

The short answer

An environment variable is a named setting your app reads when it starts, like DATABASE_URL or OPENAI_API_KEY, kept outside the code itself. On your own computer they usually live in a file called…

What it is: a named setting outside your code, read when the app starts

Where it lives: a .env file locally; the host's secrets page when live

The trap: VITE_ and NEXT_PUBLIC_ variables are shipped to the browser

Never commit .env: anything in a repository can be read by whoever can read it

Ask your AI tool this

"List every environment variable this project uses, say whether each one is sent to the browser, and flag any secret key that has a VITE_ or NEXT_PUBLIC_ prefix or is typed directly into code.…