Are NEXT_PUBLIC_ environment variables a security risk?

Environment variables prefixed with NEXT_PUBLIC_ are bundled into the client-side JavaScript and are visible to anyone who inspects your page source or network requests. This is by design in Next.js to allow client-side code to access configuration values. However, developers sometimes accidentally prefix sensitive values like API secrets, database connection strings, or private keys with NEXT_PUBLIC_, exposing them publicly. Only values that are safe to be public, such as analytics IDs or public API endpoints, should use this prefix. UNPWNED checks client-accessible bundles and responses for supported exposed-secret and environment-variable patterns; private server variables require separate review.