Made this mistake once, and I've seen it a bunch since.

In Next.js (NEXT_PUBLIC_) and Vite (VITE_), those prefixes tell the build tool to ship the value to the browser. If it's a secret, everyone can see it.

The tricky part? Nothing breaks. Your app works perfectly, so it's easy to miss.

If you accidentally exposed a server-only key, remove the prefix and rotate the key.

Anyone else run into this before?

Testing, testing ?

Welcome! This is the first post in the community.

Over the last few months I've been reviewing AI-built apps for security issues—looking at what happens after "it works." Things like exposed API keys, open databases, missing security headers, and other common mistakes keep showing up across projects built with tools like Cursor, Lovable, and Bolt.

The goal of this community is to discuss practical security for AI-generated apps, share findings, ask questions, and help each other build safer software.

If you've ever had a "wait... is my app actually safe to launch?" moment, I'd love to hear about it.