Keep secrets server-side

Encrypting an environment value at rest does not make it safe to send to the browser or print into a log.

Use secrets only in server code. In Next.js, a NEXT_PUBLIC_ prefix intentionally makes a value public at build time. Avoid logging request headers, tokens, or full environment objects. Rotate a value if it appears in a deployment log or client bundle, then redeploy and invalidate the compromised credential at its provider.

Server-only is a data-flow rule, not merely a filename convention. A server component or route can still leak a secret through serialized props, an error message, a redirect, or a response body. Return the result of using a credential, never the credential itself, and review build output for values that may have been inlined.

Use a different credential per environment with only the permissions that application needs. Rotation is complete only after the new deployment works and the old credential is revoked at the provider. Consider rollback too: restoring an older deployment may restore code that expects a credential you intentionally invalidated.

Add a fake secret to Preview, read it only in a server route that returns a boolean such as configured, and inspect browser source and logs.