System Design · Junior · Question 60 of 75

Why must secrets like a database password never be put in frontend code?

✓Correct answer: Everything shipped to the browser can be read by anyone; secrets must stay on the server
2Because frontend code is compiled
3Because browsers delete them

Explanation

Frontend env variables (NEXT_PUBLIC_, VITE_) are public. Call protected APIs through your backend.

Further reading

Test yourself

Take the System Design · Junior quiz: questions and options are shuffled, and you get a review of your mistakes at the end.