Advisory VV-004high2026-08
Secrets leaked via NEXT_PUBLIC_ (or VITE_) environment variables
Prefixing a variable with NEXT_PUBLIC_ inlines it into the JavaScript every visitor downloads. AI tools often “fix” a missing-env error this way.
What it is
Any NEXT_PUBLIC_ variable is inlined at build time by design. A common quick fix, renaming a secret with the prefix so a client component can read it, publishes the secret.
In the 30,998-app scan, 1,332 apps had something key-shaped in their JavaScript; 52 were dangerous keys such as OpenAI, AWS, Anthropic, a Stripe secret key or a Supabase service_role. Escape’s report also cites a write-up showing API keys routinely leaked in Lovable deployments.
How to check
- grep your env files and code for NEXT_PUBLIC_ / VITE_ variables holding words like SECRET, KEY, TOKEN.
- Search the deployed bundle for prefixes like sk_live_, sk-, AKIA.
How to fix
- Rotate any exposed key at the provider first.
- Call the third-party API from a server route / Edge Function and keep the key server-side.
# Find suspicious public env vars in your repo
grep -rnE "(NEXT_PUBLIC|VITE)_[A-Z_]*(SECRET|KEY|TOKEN)" --include=*.{js,ts,tsx,env} .
# Search a downloaded production bundle for common secret prefixes
grep -oE "(sk_live_[A-Za-z0-9]+|sk-[A-Za-z0-9-]{20,}|AKIA[0-9A-Z]{16})" dist/**/*.js