What is Environment variable?

Instead of writing a database password into a source file, you set it as an environment variable on your machine or host, and the code reads it at runtime. This keeps secrets out of the repository and lets each environment use different values.

The trap is that frontend build tools deliberately expose some variables to the browser. In Vite, names starting with VITE_ are placed in the client code, and in Next.js the prefix is NEXT_PUBLIC_. Both frameworks warn that such values are visible to anyone. AI tools sometimes add a secret with the public prefix just to make it reachable from a component, which publishes it.

Use the public prefix only for values that are safe to show, like an anon key or analytics id. Read real secrets only in server code, and set them in your hosting dashboard rather than in committed files.