Guides / NEXT_PUBLIC_ secret exposed

v0 / Next.js apps: NEXT_PUBLIC_ variables are public

In Next.js apps built with v0, any NEXT_PUBLIC_ variable is shipped to the browser. How to check for leaked secrets and fix it.

What it is

v0 generates Next.js apps. In Next.js, environment variables are server-only by default. Anything prefixed with NEXT_PUBLIC_ is inlined into the JavaScript sent to the browser at build time. If a secret key gets that prefix, it is public. Keep secrets un-prefixed and use them only in server code (Route Handlers, Server Actions, Server Components).

How to check

1. List every NEXT_PUBLIC_ variable in your Vercel project settings and .env files.
2. Any secret (OpenAI, Stripe secret, database URL, Supabase secret key) with that prefix is exposed.
3. Search the live site’s JS bundles for the key values, or run a free Cobalt Owl scan.

Fix it with one prompt

Paste this into Lovable, Bolt, Cursor, v0, Replit or Claude Code:

Check my Next.js app for secrets in NEXT_PUBLIC_ environment variables. Rename every secret so it has no NEXT_PUBLIC_ prefix, use it only in server code (Route Handlers, Server Actions or Server Components), and make the client call those server routes instead. Update the variables in Vercel. Then list the keys I need to rotate because they were exposed.

Review what the AI changes before you publish. If a key was exposed, rotate it even after the fix: anyone may already have a copy.

Sources

• Next.js: Environment variables
• Vercel: Environment variables
• v0 docs

Last reviewed October 25, 2026. Cobalt Owl is an independent tool and is not affiliated with the builders or providers named here.