SEV-1: blocks launch

A server secret has a browser-visible name

What goes wrong

Your build tool copies it into the JavaScript every visitor downloads, where anyone can read it.

Rename this variable without the public prefix, and move the call that needs it into a server route or edge function.

npx sigship

Run it in your project. It reports this check as public-env-secret, along with 16 others. Nothing leaves your machine.