DaemonCoreLaunchpad Wizardby DaemonCore
all labs
Securein progress

Environment Variable Lab

Public does not mean secret. Classify ten real examples.

daemoncore rule

Public does not mean secret.

A variable marked public isn't protected by anything — it is deliberately shipped to every visitor's browser. Marking a secret as public doesn't make it safe; it makes it published.

.envYour machine only
VITE_SUPABASE_URL=https://abc.supabase.co
VITE_SUPABASE_PUBLISHABLE_KEY=sb_publishable_…
STRIPE_SECRET_KEY=sk_live_…

Never committed. Listed in .gitignore. Every developer keeps their own.

.env.exampleCommitted on purpose
VITE_SUPABASE_URL=
VITE_SUPABASE_PUBLISHABLE_KEY=
STRIPE_SECRET_KEY=

Names only, no values. It documents what a new developer must supply.

Hosting dashboardProduction
VITE_SUPABASE_URL      ●●●●●●
STRIPE_SECRET_KEY      ●●●●●●
(added per environment, then redeploy)

Your build server has never seen your .env file. This is where production gets its values.

where a secret is allowed to travel

browser

Public configuration only

Site URL, public keys, analytics IDs.

→

your server

Secrets live here

Read from environment at runtime, never sent down.

→

third party

Stripe · email · AI

Authenticated by the secret your server holds.

plain englishThe browser gets the address of the shop. Your server keeps the keys to the safe.
challenge — which of these can safely be exposed?0/10 correct
  • PUBLIC_SITE_URL
  • VITE_SUPABASE_URL
  • VITE_SUPABASE_PUBLISHABLE_KEY
  • DATABASE_ADMIN_PASSWORD
  • STRIPE_SECRET_KEY
  • SERVICE_ROLE_KEY
  • NEXT_PUBLIC_ANALYTICS_ID
  • SMTP_PASSWORD
  • OPENAI_API_KEY
  • PUBLIC_SUPPORT_EMAIL
0/10 classified
next labDon't Get Owned 101 →