Tag

#secrets articles

Articles related to this tag. If you’re new, start with the newest posts.

October 20, 2026·9 min read

Next.js environment variables: find and stop secrets leaking to the client (2026)

Three ways a Next.js App Router build leaks server secrets even without NEXT_PUBLIC_: props to Client Components, process.env reads in prerendered Client Components, and frozen public values. Tested on Next.js 15.1.9, with a build scanner for CI.