gspot/no-client-env
Finds private environment reads in client modules, including process.env, Bun.env, Deno.env, and import.meta.env. The publicPrefixes and allowed options name public values.
The recommended and all configs turn it on.
Client code needs public configuration. Private environment values are unavailable in the browser by default, and exposing a secret to satisfy the read is unsafe.
What to do
Section titled “What to do”Keep private configuration and the work that needs it in a server-only module. Pass only public results to client code, or use NEXT_PUBLIC_ variables for values intended for the browser.
Example
Section titled “Example”In a module beginning with "use client", const key = process.env.SECRET; reports private. Move the secret read and the work that needs it to a server module. A genuinely public URL can use process.env.NEXT_PUBLIC_URL in the client. Never rename a secret to make it public. See Next.js environment variables.
Options
Section titled “Options”| Option | Type | Default | What it does |
|---|---|---|---|
isClient |
true or false |
false |
Treat selected files as client code without a use-client directive. |
publicPrefixes |
List | ["NEXT_PUBLIC_"] |
Prefixes allowed for public environment variables. |
allowed |
List | ["NODE_ENV"] |
Environment variable names allowed in client code. |