Non-public env var in client code
Why it matters
Only NEXT_PUBLIC_* variables are inlined into the browser bundle; any other process.env read is undefined there (and naming a secret in client code is a leak risk).
Fix
Read it on the server and pass the value down, or rename it NEXT_PUBLIC_ if it is safe to expose.
Credit
From the Next.js team
Only NEXT_PUBLIC_-prefixed environment variables are inlined into the browser bundle; everything else stays server-side.