Can a malicious actor easily access .env variables in nextJs that have the NEXT_PUBLIC prefix or as they just as safe as the other .env variables?
>Solution :
Yes, NEXT_PUBLIC prefix allows NextJS to send the variable to the client’s browser.
From the docs:
The value will be inlined into JavaScript sent to the browser because of the NEXT_PUBLIC_ prefix.
Don’t use sensitive data with the NEXT_PUBLIC prefix.