Are NEXT_PUBLIC_ environment variables a security risk?

Environment variables prefixed with NEXT_PUBLIC_ are bundled into the client-side JavaScript and are visible to anyone who inspects your page source or network requests. This is by design in Next.js to allow client-side code to access configuration values. However, developers sometimes accidentally prefix sensitive values like API secrets, database connection strings, or private keys with NEXT_PUBLIC_, exposing them publicly. Only values that are safe to be public, such as analytics IDs or public API endpoints, should use this prefix. UNPWNED scans your deployed application for exposed environment variables and flags any that appear to contain sensitive credentials.