Your API key is public? How to protect API keys in your frontend
Anything that starts with NEXT_PUBLIC_ or VITE_ ships to every visitor. Here’s how to find a leaked key in two minutes, move it to the server with copy-paste code, and rotate it properly if it already reached GitHub.


