What you need to know
Environment variables let deployments use different configuration without committing secrets. Variables with a public prefix are exposed to client code, so they should never contain private credentials.
How to apply it
Store private keys and database URLs in the hosting environment, access them only from server code, and document required variable names without copying secret values into examples.
Common mistake to avoid
Do not commit .env files or place private values in NEXT_PUBLIC variables. Rotate a credential if it was ever published in source or logs.