Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Next.js

Keys committed to GitHub in Next.js

criticalUpdated Oct 12, 2026

Read secrets from the environment at runtime on the server. Do not default them in source code "for local dev." Use .env.local , which Next.js gitignores in a typical app, and keep .env.example free of real values.

Fix for Next.js

Read secrets from the environment at runtime on the server. Do not default them in source code "for local dev." Use .env.local, which Next.js gitignores in a typical app, and keep .env.example free of real values.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Next.js fixes are on the Next.js page.