Set Up Environment Variables & Secrets for Production

Audit the Project Before Adding Anything

Use your AI coding assistant to audit the project before adding anything to production.

Production Environment Variable Audit

Returns every environment variable the project uses — names only, never values — with where each one is used, which service needs it, whether it is public or private, whether it is needed at build time or runtime, and whether production needs a different value. Ends with a short production environment-variable checklist.

Review this project specifically for production environment variables and secrets. Identify every environment variable the project uses and return the variable names only — never secret values. For each variable, tell me: - where it is used - what service or feature requires it - whether it is public/client-side or private/server-side - whether it is required during the production build, at runtime, or both - whether it needs a different value for production Pay special attention to framework-specific public prefixes such as: - `VITE_` - `NEXT_PUBLIC_` Also check: - `.env`, `.env.local`, and other environment files - hosting or deployment configuration - authentication - databases - APIs - AI services - Stripe or other payment services - storage - email - OAuth - webhooks Do not change anything yet. Finish with a short production environment-variable checklist.

Keep this checklist for the next steps.

Keep Private Credentials Out of the Browser and the Repository

Before deployment, make sure private credentials cannot reach the browser or repository.

Unsafe Secret Handling Check

Uses the audit from Step 1 to find secrets exposed in client-side code, private .env files committed to Git, and public prefixes used on values that are not safe to expose — fixing only genuine security or production configuration problems, and returning the final list of variable names to configure in production.

Using the environment-variable audit, check this project for unsafe secret handling. Fix only genuine security or production configuration problems. Specifically: - make sure private API keys, database credentials, service-role keys, tokens, and other secrets are not exposed in client-side code - make sure private `.env` files are not committed to Git - check that public environment-variable prefixes are used only for values that are safe to expose - move secret-dependent logic to server-side code when required - preserve the existing functionality and architecture unless a security fix genuinely requires a change Do not generate or replace real secret values. When finished, tell me what changed and give me the final list of environment-variable names I need to configure in production.

Browser-Exposed Prefixes

VITE_ NEXT_PUBLIC_

VITE_

Vite exposes these variables to client code

NEXT_PUBLIC_

Next.js bundles these variables into browser JavaScript

IMPORTANT

Private secrets should not use those prefixes.

Enter the Variables in Your Hosting Dashboard

Open your hosting dashboard and add the variables from the checklist.

For Hostinger Web Apps, open the application's Environment variables section and add each required key with its production value.

Hostinger Web App Environment variables

You can also add environment variables during the initial deployment. Hostinger currently supports adding them individually or importing them from a .env file.

Use the production credentials and URLs for services that require separate environments.

IMPORTANT

Never commit the production .env file or secret values to GitHub.

Redeploy, Then Test What Depends on Them

Apply the environment-variable changes and rebuild or redeploy the project when required.

This is especially important for variables embedded during the build, such as many VITE_ or NEXT_PUBLIC_ values.

Then test the features that depend on them:

Authentication

Database connections

APIs

AI features

Payments

Forms

Storage and uploads

Email

OAuth

Webhooks

NOTE

If something still fails, check the deployment or runtime logs and confirm that the variable name and production value are both correct.

Your website or web app is ready when its production services work without exposing private secrets.