A VITE_ variable bundles a secret into the client

Symptom

An API key works in the browser preview. Anyone who opens the built JavaScript can read it.

Root cause

Vite's env guide says variables prefixed with VITE_ are exposed in client source after bundling, statically replaced at build time. Variables without that prefix are not exposed. The same page says VITE_ variables must not contain API keys or other secrets, and that production secrets belong in a backend or an edge function. This card applies when the generated app is a Vite client. The value is in the bundle even if the UI never displays it.

In this Vite project only:

1. Find every VITE_ variable whose value is a secret (API keys, service role keys, webhook secrets, database URLs).
2. Rename them so they are not prefixed with VITE_, and read them only in server code or an edge function.
3. Leave VITE_ only on values that are safe to publish, such as a public site URL or a publishable Supabase key.
4. Rebuild and confirm the secret string is gone from the dist JavaScript.

Do not paste the secret values into the chat.

Paste this into the coding tool that has your own project open.

2-minute self-check

These steps are for an app you own. Do not run them against someone else's project.

1. In your own project, open .env files and list every name that starts with VITE_.
2. Build your own app and search the output JavaScript for a secret value you recognize. It should not be there.
3. If it is there, rotate that credential after you remove the VITE_ prefix and redeploy.

Sources

• Vite: Env Variables and Modes