How secure is to define database env variable with prefix `NEXT_PUBLIC_`?

Exposing sensitive values to the browser is not a good idea. I believe database value is only used on API routes. In that case, those are purely backend serverless functions. We don’t need to provide a NEXT_PUBLIC_ prefix if it is just used directly from the backend.

You can check more details here. https://nextjs.org/docs/basic-features/environment-variables

[ghoshnirmalya]

@ghoshnirmalya 👍 the API folder inside the pages folder is special in the next Js context. it will be server-side only. You can check the details here man. https://nextjs.org/docs/api-routes/introduction

From the docs,

Any file inside the folder pages/api is mapped to /api/* and will be treated as an API endpoint instead of a page. They are server-side only bundles and won’t increase your client-side bundle size.

@Param-Harrison Thank you. Can you please create a PR for that?

[ghoshnirmalya]

NEXT_PUBLIC_DATABASE_URL is used in the nextauth.ts file. It’s used only on API routes. I’ll check whether NextAuth will work if we don’t provide the credentials on the client side.