Environment Variables & Configuration
Environment variables are configuration inputs to a build or server process. A crucial security rule is that anything embedded into browser JavaScript should be considered public. API keys that require secrecy must stay on a trusted server.
Different build systems expose environment variables differently. Do not assume that a variable available to a Node process is automatically available in browser code. Read your framework's conventions and distinguish build-time values from runtime server secrets.
For client configuration, prefer a small typed configuration module rather than reading environment variables throughout the application.
Never put database passwords, private API keys, signing secrets, or credentials into a client-exposed environment variable.
const config = {
apiBaseUrl: import.meta.env.VITE_API_BASE_URL,
} as const;
export default config;- Client-exposed environment values are not secrets.
- Keep configuration access centralized.
- Know whether a value is evaluated at build time or server runtime.