Web Security · Junior · Question 71 of 75

In Next.js, which environment variables end up in the browser bundle?

1None, the browser never sees any variables
2All variables in .env.local
✓Correct answer: Only those with the NEXT_PUBLIC_ prefix

Explanation

NEXT_PUBLIC_ variables are inlined at build time and become public. Secrets must not have this prefix and must be used only in server code.

Further reading

Test yourself

Take the Web Security · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.