Public env vars, the Supabase anon key, and row level security in Vite
By ShipSecurely Editorial · Updated · How we make these guides
high
Treat every VITE_ value as client source. Vite's guide says the prefix exists so the value is bundled, and that it should not hold an API key.
Fix for Vite
Treat every VITE_ value as client source. Vite's guide says the prefix exists so the value is bundled, and that it should not hold an API key. A name without the prefix is undefined on import.meta.env. Move a secret to a server or edge function. The Supabase publishable key is the exception Supabase documents, and only with row level security enabled.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Vite fixes are on the Vite page.