Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Next.js

Secret keys shipped in the frontend in Next.js

criticalUpdated Oct 12, 2026

Assume every NEXT PUBLIC value is public. Do not pass a secret as a prop into a client component.

Fix for Next.js

Assume every NEXT_PUBLIC_ value is public. Do not pass a secret as a prop into a client component. Server Actions and Route Handlers can read process.env.SUPABASE_SECRET_KEY. A client component cannot, unless you made it public.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Next.js fixes are on the Next.js page.