Scan rule · RSC-SEC-057
Secret exposed via a public env prefix
Finds variables with a public bundler prefix (`NEXT_PUBLIC_`, `VITE_`, `REACT_APP_`, `PUBLIC_`, `EXPO_PUBLIC_` …) whose name implies a secret — such values are compiled into the client bundle.
Why this matters
Every bundler has a prefix that means “may go to the browser”: `NEXT_PUBLIC_` in Next.js, `VITE_` in Vite (and therefore in Lovable and Bolt), `REACT_APP_` in Create React App. Values with that prefix are inlined at build time into the JavaScript every visitor downloads.
If such a variable carries a secret by name — `VITE_SUPABASE_SERVICE_ROLE_KEY`, `NEXT_PUBLIC_STRIPE_SECRET` — the secret is published. The name alone is the proof; the value does not need to be found.
Source maps make this especially visible: the bundler replaces the access with the value at build time, so the NAME disappears from the bundle — but it is still there in the reconstructed original source. Fix: drop the prefix, move access behind a server endpoint, and rotate the key.
Scan tier
How to fix it
Drop the prefix, use the value server-side, and rotate the secret.