Your NEXT_PUBLIC secret is already in the browser bundle

Problem In a Next.js app it’s easy to slip a secret (e.g., STRIPE_SECRET_KEY, OpenAI API...