SH006: Secret exposed to the browser

Severity: high · Category: secrets · Applies to: nextjs, react

Why it matters

Variables prefixed NEXT_PUBLIC_, VITE_ or REACT_APP_ are copied into the JavaScript bundle that every visitor downloads.

How to fix

Keep the secret on the server and expose a backend endpoint instead.

Ignoring this rule

Skip it everywhere in devshield.yml:

ignore:
  - SH006

Or skip one line with a comment on that line or the line above:

devshield-ignore: SH006