Deployment guide
Use Vite environment variables safely.
Static frontend settings are compiled into browser assets. RunYour.App accepts declared public VITE_* values for supported SPA builds, but never treats them as server secrets.
- VITE_* names only
- Build phase for static apps
- Browser-visible values
- Runtime values for APIs
Public means public
Any value referenced through import.meta.env in a Vite frontend can become visible in downloaded JavaScript. API base URLs, public project identifiers, and publishable browser keys may be appropriate. Private API keys, database passwords, and service-role keys are not.
Static build values
- The name must follow the VITE_* convention.
- The repository must declare that the value is non-secret and needed for the build.
- The value is bound to the build and its cache identity.
- Changing a frontend value requires a new build and deployment.
Express and FastAPI are different
Supported Express and FastAPI services receive configuration at runtime. Their server-side values are not compiled into browser assets and can be used for ordinary external API calls under the runtime policy.