Separate public settings from secrets
Only values intended for browser code should use the framework's public-variable mechanism. Database credentials, signing keys, and private API tokens must stay server-side and should be stored in the hosting provider's protected environment configuration.
Use distinct credentials and services for nonproduction environments where possible. This limits the impact of a preview leak and allows test data to be reset without affecting live users.
Check scope and rotation
Confirm whether a variable applies to all deployments, only a named environment, or a particular branch or preview. After changing a value, create or restart a deployment as required by the hosting platform; existing processes may keep their original environment.
Rotate exposed credentials at the issuing service, update the hosting configuration, and redeploy. Avoid printing values in logs; verify presence and expected format without echoing the secret itself.