Fixes › Env vars & leaked keys

Environment variable is undefined in production

Cursorv0Bolt

The error

process.env.X is undefined / import.meta.env.VITE_X is undefined after deploy

Why it happens

Your .env file is not uploaded when you deploy. Variables must be added in the hosting dashboard (Vercel, Netlify), and client-side values need the framework prefix (NEXT_PUBLIC_ for Next.js, VITE_ for Vite). Values are embedded at build time, so you must redeploy after adding them.

How to fix it

1. Add the variable in Vercel → Project → Settings → Environment Variables for Production (and Preview).
2. Use the right prefix for values the browser needs; keep secrets unprefixed and server-only.
3. Redeploy, since env changes apply only to new builds.
4. Log on the server whether the variable exists (never log its value).

Fix prompt (paste into Lovable, Bolt, Cursor, Replit or v0)

Environment variable <NAME> works locally but is undefined in production on Vercel. Check whether it's read in client or server code, rename it with NEXT_PUBLIC_/VITE_ only if it is safe to be public, otherwise move the usage to server code. List the exact variables I must add in the Vercel dashboard and remind me to redeploy.

FAQ

Why does it work locally?

Your local dev server reads .env; the deployed build doesn't have that file.

Do I need to redeploy?

Yes. Env vars are injected at build/deploy time.

Related fixes

• Supabase service_role key exposed in frontend code
• OpenAI / Stripe secret key leaked in the browser
• OpenAI 429 'You exceeded your current quota' or a surprise AI bill
• .env file committed to GitHub