Why it matters

Astro exposes PUBLIC_ environment variables to client-side code. Names containing TOKEN, SECRET, PASSWORD, PRIVATE, or KEY as underscore-separated segments usually indicate accidental secret exposure. Dot access, static bracket access, and destructuring are checked; names such as PUBLIC_KEYBOARD_LAYOUT are allowed.

See the difference

Incorrect

Secret-looking public env variable

---
const apiKey = import.meta.env.PUBLIC_API_KEY
---
<p>{apiKey}</p>

Correct

Server-only secret

---
const apiKey = import.meta.env.API_KEY
const publicUrl = import.meta.env.PUBLIC_API_URL
---
<p>{publicUrl}</p>

Configure this check

Override the default severity in your ESLint config:

import astroDoctorPlugin from '@santi020k/eslint-plugin-astro-doctor'

export default [
  astroDoctorPlugin.configs.recommended,
  {
    rules: {
      'astro-doctor/no-public-secret-env': 'error',
    },
  },
]

Or set the severity for CLI scans in doctor.config.ts:

export default {
  rules: {
    'astro-doctor/no-public-secret-env': 'error',
  },
}

Use 'error', 'warn', or 'off'. The configuration guide covers presets and per-file overrides.

Keep exploring security

Browse every rule and project audit