VITE_ means visible: Ember's note on env variables

Ember thought "env variable" meant "secret." Then she sniffed a Vite app and found the key sitting in the JavaScript, like a treat in an open lunchbox.

Here's the catch: in Vite apps, which many Lovable and Bolt projects use, anything starting with VITE_ is bundled into the code every visitor downloads. Public keys are fine there. Secret keys are not.

The one thing to do

1. Search your project for VITE_.
2. Anything secret, like a payment or AI key? Move it to a server function and rotate it.

The details are in the Vite env guide. Then run a free scan of your own app at sniffpup.com.

Want one 2-minute check like this every morning? Sign up below.

Named after Ember, my black Pomeranian. Built by a software engineer and vibe-coding hobbyist to help you ship safely.