From fb339c57de12d97b996e0930b3d12bce561ea6ff Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Fran=20Jurmanovi=C4=87?= Date: Sun, 1 Mar 2026 14:50:25 +0100 Subject: [PATCH] Use non-public env variables for sensitive credentials - NEXT_PUBLIC_API_BASE: Keep public (just the endpoint URL) - SERVER_ID: Remove NEXT_PUBLIC_ prefix (private identifier) - ACCESS_TOKEN: Remove NEXT_PUBLIC_ prefix (sensitive credential) Since fetching is server-side, credentials never reach the browser. Only API_BASE needs to be public if accessed from client in future. --- .env.local.example | 4 ++-- src/lib/api.ts | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.env.local.example b/.env.local.example index b0c93b9..bde281e 100644 --- a/.env.local.example +++ b/.env.local.example @@ -1,3 +1,3 @@ NEXT_PUBLIC_API_BASE=https://acc-api.jurmanovic.com/v1/api -NEXT_PUBLIC_SERVER_ID=2ea19460-f3b6-47ae-a667-c26876425268 -NEXT_PUBLIC_ACCESS_TOKEN=EB41048A021F7A7707ED4E5EF37052C401F9ACD5DCDBC94BF16D0456FAAF111A +SERVER_ID=2ea19460-f3b6-47ae-a667-c26876425268 +ACCESS_TOKEN=EB41048A021F7A7707ED4E5EF37052C401F9ACD5DCDBC94BF16D0456FAAF111A diff --git a/src/lib/api.ts b/src/lib/api.ts index ac973aa..371dae5 100644 --- a/src/lib/api.ts +++ b/src/lib/api.ts @@ -2,8 +2,8 @@ import { AppData } from './types'; export async function fetchLeaderboard(): Promise { const API_BASE = process.env.NEXT_PUBLIC_API_BASE || ''; - const SERVER_ID = process.env.NEXT_PUBLIC_SERVER_ID || ''; - const ACCESS_TOKEN = process.env.NEXT_PUBLIC_ACCESS_TOKEN || ''; + const SERVER_ID = process.env.SERVER_ID || ''; + const ACCESS_TOKEN = process.env.ACCESS_TOKEN || ''; if (!API_BASE || !SERVER_ID || !ACCESS_TOKEN) { console.warn('Missing API configuration');