Public values and runtime secrets stay separate.
Declared NEXT_PUBLIC_* values are non-secret build inputs. Next.js can embed them in browser assets, so URLs and publishable client keys must be treated as public.
Runtime-only server values may be secret and are bound to the deployed revision. Secret build-time variables are rejected; never place a Supabase service-role key or other server credential in a browser-visible variable.
