Is sensitive data in NextJS .env file safe if it has NEXT_PUBLIC prefix?

Question

Can a malicious actor easily access .env variables in nextJs that have the NEXT_PUBLIC prefix or as they just as safe as the other .env variables?

score 2 · Accepted Answer · answered Oct 17 '22 at 17:32

2

Yes, NEXT_PUBLIC prefix allows NextJS to send the variable to the client's browser.

From the docs:

The value will be inlined into JavaScript sent to the browser because of the NEXT_PUBLIC_ prefix.

Don't use sensitive data with the NEXT_PUBLIC prefix.

answered Oct 17 '22 at 17:32

Frederic Perron

1 Answers1