Skip to content

Scan rule · RSC-SEC-057

Secret exposed via a public env prefix

SecuritySeverity: HighCWE-798

Finds variables with a public bundler prefix (`NEXT_PUBLIC_`, `VITE_`, `REACT_APP_`, `PUBLIC_`, `EXPO_PUBLIC_` …) whose name implies a secret — such values are compiled into the client bundle.

Why this matters

Every bundler has a prefix that means “may go to the browser”: `NEXT_PUBLIC_` in Next.js, `VITE_` in Vite (and therefore in Lovable and Bolt), `REACT_APP_` in Create React App. Values with that prefix are inlined at build time into the JavaScript every visitor downloads.

If such a variable carries a secret by name — `VITE_SUPABASE_SERVICE_ROLE_KEY`, `NEXT_PUBLIC_STRIPE_SECRET` — the secret is published. The name alone is the proof; the value does not need to be found.

Source maps make this especially visible: the bundler replaces the access with the value at build time, so the NAME disappears from the bundle — but it is still there in the reconstructed original source. Fix: drop the prefix, move access behind a server endpoint, and rotate the key.

Scan tier

Source code from source mapsRepo access (deep scan)

How to fix it

Drop the prefix, use the value server-side, and rotate the secret.

Scan your own app for free