---
title: "Non-public env var in client code (next/client-env)"
description: "Only NEXT_PUBLIC_* variables are inlined into the browser bundle; any other process.env read is undefined there (and naming a secret in client code is a leak risk)."
url: http://localhost:4173/rules/next/client-env
updated: 2026-11-11
---

# Non-public env var in client code

> `next/client-env` is a vetd rule. It flags: Non-public env var in client code. It runs on every `check`, together with the TypeScript check.

| Fact | Value |
| --- | --- |
| Rule id | `next/client-env` |
| Severity | error or warning |
| Group | Server and client boundaries |
| Tags | security, nextjs-16 |

## Why it matters

Only NEXT_PUBLIC_* variables are inlined into the browser bundle; any other process.env read is undefined there (and naming a secret in client code is a leak risk).

## How to fix it

Read it on the server and pass the value down, or rename it NEXT_PUBLIC_ if it is safe to expose.

## Credit

Based on work by:

- [Next.js team](https://nextjs.org): Only NEXT_PUBLIC_-prefixed environment variables are inlined into the browser bundle; everything else stays server-side.

## References

- [How to use environment variables in Next.js](https://nextjs.org/docs/app/guides/environment-variables), Next.js
- [How to think about data security in Next.js](https://nextjs.org/docs/app/guides/data-security), Next.js

## See it

Demos in the vetd Lab:

- [Keep secrets out of code](http://localhost:4173/lab/web-standards/secrets-in-env)

## Related rules

- [`next/server-only-in-client`](http://localhost:4173/rules/next/server-only-in-client.md)

## Get this text from vetd

MCP: call `explain` with `{ "diagnosticId": "next/client-env" }`. CLI: `npx vetd explain next/client-env`.

---

[All 92 rules](http://localhost:4173/rules.md) · Previous: [`next/unknown-route`](http://localhost:4173/rules/next/unknown-route.md) · Next: [`next/async-client-component`](http://localhost:4173/rules/next/async-client-component.md)