Is your API key in your JavaScript? VITE_ and NEXT_PUBLIC_ explained

Env vars keep keys out of Git, not out of the browser. Which keys are safe in the frontend, how to check your live site in two minutes, and the fix.