What is Environment variable?

Also called env var, .env file.

An environment variable is a setting stored outside your code — a database password, an API key — so it never gets committed or published. Whether it stays private depends entirely on how it is named and where it is read.

In more detail

Front-end frameworks compile any variable carrying a public prefix (NEXT_PUBLIC_, VITE_, REACT_APP_) directly into the JavaScript downloaded by visitors. That is intended behaviour for genuinely public values. Adding the prefix to make an undefined-variable error go away publishes the secret and silences the error at the same time.

Why it matters for your site

Two failures produce the same outcome. A secret with a public prefix is compiled into the bundle. A .env file left in the deployed directory can be downloaded directly. Both are public until you rotate what was in them.