Leaked environment variables

Variables with a public prefix are copied into the page at build time.

What it is

Frameworks copy variables that start with NEXT_PUBLIC_, VITE_, REACT_APP_ or NUXT_PUBLIC_ into the files every visitor downloads. A secret placed in one of those variables is published with the next deploy.

Why it matters

The prefix is a promise that the value is safe to show. A token, a database password or a service key under that prefix breaks the promise, and the value is readable in the browser from then on. Tenty rates the finding by how secret the name and the value look.

How Tenty checks it

Tenty reads this from the page and the script files every visitor receives. The check runs on every scan, and the finding names the place where the value appears. Tenty looks for public prefixes next to names such as SECRET, PRIVATE and SERVICE_ROLE, and for variables whose name suggests a secret and whose value is long and random.

How to fix it

1. Rotate the value at its provider. 2. Rename the variable without the public prefix and read it only in server code. 3. Send the browser a result from your server and keep the secret out of the browser. 4. Rebuild and deploy, then check the new files for the old value.

How to reproduce

curl -sS 'https://YOUR-APP/assets/app.js' | grep -o 'VALUE_START[A-Za-z0-9_-]*'

Use the first characters of the value. A match means it ships to visitors.