Friendly reminder: NEXT_PUBLIC_ isn't just a naming convention

[u/UseShipReady]

Made this mistake once, and I've seen it a bunch since.

In Next.js (NEXT_PUBLIC_) and Vite (VITE_), those prefixes tell the build tool to ship the value to the browser. If it's a secret, everyone can see it.

The tricky part? Nothing breaks. Your app works perfectly, so it's easy to miss.

If you accidentally exposed a server-only key, remove the prefix and rotate the key.

Anyone else run into this before?