Classify the value before naming it
An environment variable is a way to supply configuration, not a guarantee that its value remains private. Decide whether the value is safe for every visitor to inspect. A public API base URL is different from a privileged API credential. This classification should happen before a developer chooses a framework prefix or adds a value to a build command.
Understand build-time substitution
In Next.js, supported NEXT_PUBLIC_ references are inlined into browser code at build time. Changing a host’s environment after the artifact is built does not rewrite that existing JavaScript. Treat those values as part of the artifact’s inputs and record the intended environment. Otherwise, a production deployment can continue calling the preview service even though the server dashboard shows a new setting.
Trace a practical configuration error
Imagine a bundle built with NEXT_PUBLIC_API_ORIGIN pointing to https://preview.example.com. Promoting those exact files to the production domain preserves that embedded origin. Either build the artifact with the intended public value or design an explicit runtime configuration mechanism appropriate to the hosting model. Do not assume that moving files changes constants already included in them.
Keep secrets out of client output
Do not place privileged tokens in a public variable, metadata object or generated source file. A variable without a public prefix still needs careful handling: code can accidentally serialize its value into HTML or logs. Keep sensitive operations on an appropriate protected backend, and give automation only the credentials required for its actual publishing task.
Validate configuration early
Check required values at the stage where they are needed and produce an error that names the missing setting without printing its contents. Document which variables are public, required, optional or environment-specific. Use example configuration files with harmless placeholder values, and keep real local secrets outside version control. Distinguish a missing setting from an unavailable remote service when reporting failures.
Inspect the generated artifact
Before release, inspect the public network requests and generated files for unexpected origins or exposed credentials. Verify configuration against the deployed site, not only the pipeline’s variable list. If a secret was shipped publicly, removing it in a later build is insufficient because copies may remain cached; follow the relevant credential rotation process. Configuration review belongs beside code review because it changes application behavior.
Further reading
Put the idea to work.
Explore free browser tools for images, text and developer workflows.