Skip to content
astro-doctor
Securitywarn by defaultrecommended presetastro-doctor/no-public-secret-env

no-public-secret-env

Warn when PUBLIC_ environment variables appear to contain secrets.

Why

Astro exposes PUBLIC_ environment variables to client-side code. Names like PUBLIC_TOKEN, PUBLIC_SECRET, PUBLIC_PASSWORD, and PUBLIC_API_KEY usually indicate accidental secret exposure.

Examples

Incorrect

Secret-looking public env variable

astro
---
const apiKey = import.meta.env.PUBLIC_API_KEY
---
<p>{apiKey}</p>

Correct

Server-only secret

astro
---
const apiKey = import.meta.env.API_KEY
const publicUrl = import.meta.env.PUBLIC_API_URL
---
<p>{publicUrl}</p>

Configuration

Override the default severity in your ESLint config:

javascripteslint.config.js
// eslint.config.js
import astroDoctorPlugin from '@santi020k/eslint-plugin-astro-doctor'

export default [
  astroDoctorPlugin.configs.recommended,
  {
    rules: {
      'astro-doctor/no-public-secret-env': 'error',   // or 'warn' or 'off'
    },
  },
]

Or in your doctor.config.ts:

typescriptdoctor.config.ts
export default {
  rules: {
    'astro-doctor/no-public-secret-env': 'error',
  },
}

All rules

Edit this page on GitHub ↗