Checks · SEC-004

SEC-004 · Public env prefix on a secret

Why it matters

Variables prefixed with NEXT_PUBLIC_ or VITE_ are shipped to the browser. A secret in one of them is no longer a secret.

How we detect it

Environment names that look like secrets and start with a public prefix.

How we fix it

Rename the variable so it is only available on the server, and update the code that reads it.

Can it be fixed automatically? Yes, with a template change

Related checks

• SEC-001 · Secret committed in repo (current tree)
• SEC-002 · Secret in git history
• SEC-003 · Service-role or secret key in client bundle
• SEC-005 · AI provider key used from browser