What are environment variables?
Environment variables are settings that live outside your code, in your hosting dashboard or a local .env file, and are read by your app when it runs. They are where secrets such as API keys and database passwords belong, so they never get saved in your code or shown to visitors.
ON THIS PAGE
What it means
Instead of writing a key straight into a file, your code asks for it by name, like OPENAI_API_KEY. The real value is set separately for each place the app runs.
That also lets you use different keys for testing and for your live site, and swap a key without changing any code.
Why it matters for vibe-coded apps
Many tools add a prefix, like NEXT_PUBLIC_ or VITE_, that deliberately sends a variable to the browser. Putting a secret behind one of those makes it public.
- A key written into code gets copied to GitHub and to every visitor's browser.
- A variable with a public prefix is visible to anyone who views your page source.
- Mixing up test and live keys can charge real cards or send real emails.
Example
A Stripe secret key used in a checkout function.
const stripe = new Stripe("sk_live_51Hx…");// Set STRIPE_SECRET_KEY in your hosting dashboard (no public prefix)
const stripe = new Stripe(process.env.STRIPE_SECRET_KEY);Only values meant to be public, like a publishable key, should use NEXT_PUBLIC_ or VITE_.
How to check if your app has this problem
- 1Search your code for long key-like strings, and for sk_, secret and password.
- 2Look at every variable that starts with NEXT_PUBLIC_ or VITE_. Each one must be safe to show to everyone.
- 3Check that .env is listed in your .gitignore file.
The quicker way: LetMeCheck tests for this automatically, from the outside, the way an attacker would.
Run a free scan →How to fix it
- 1Move every secret into an environment variable and read it only in server code.
- 2Add .env to .gitignore, and add a .env.example file with empty values.
- 3Rotate any key that was ever in your code or in git history.
- 4Set the variables in your hosting dashboard for the live site.
Find every hard-coded secret in my project (API keys, tokens, passwords, database URLs). Move each one to an environment variable read only in server-side code, add .env to .gitignore, create a .env.example with empty values, and make sure no secret uses a NEXT_PUBLIC_ or VITE_ prefix. Tell me which keys I need to rotate. Don't change anything else.
Check if your app has this problem
Paste your website and we'll check for environment variables issues and other common issues in AI-built apps. Free, about a minute, and nothing on your site is changed.
Last updated
Related terms
- API key exposureA secret key for a paid service ends up where the public can see it.
- Exposed .env fileYour secrets file can be downloaded from your live website.
- Service role keyA Supabase key that skips every security rule, meant only for your server.
- Hallucinated packagesAdd-ons an AI suggests that don't exist, or that attackers have since created.
Need help?
Not sure what this means for your app? Our team will explain it in plain English.