# gspot/no-client-env

> Finds private environment reads in client modules, including process.env, Bun.env, Deno.env, and import.meta.env. The publicPrefixes and allowed options name public values.

Finds private environment reads in client modules, including process.env, Bun.env, Deno.env, and import.meta.env. The publicPrefixes and allowed options name public values.

The `recommended` and `all` configs turn it on.

## Why

Client code needs public configuration. Private environment values are unavailable in the browser by default, and exposing a secret to satisfy the read is unsafe.

## What to do

Keep private configuration and the work that needs it in a server-only module. Pass only public results to client code, or use NEXT\_PUBLIC\_ variables for values intended for the browser.

## Example

In a module beginning with `"use client"`, `const key = process.env.SECRET;` reports `private`. Move the secret read and the work that needs it to a server module. A genuinely public URL can use `process.env.NEXT_PUBLIC_URL` in the client. Never rename a secret to make it public. See [Next.js environment variables](https://nextjs.org/docs/app/guides/environment-variables).

## Options

| Option           | Type              | Default            | What it does                                                        |
| ---------------- | ----------------- | ------------------ | ------------------------------------------------------------------- |
| `isClient`       | `true` or `false` | `false`            | Treat selected files as client code without a use-client directive. |
| `publicPrefixes` | List              | `["NEXT_PUBLIC_"]` | Prefixes allowed for public environment variables.                  |
| `allowed`        | List              | `["NODE_ENV"]`     | Environment variable names allowed in client code.                  |