In Next.js, any variable prefixed NEXT_PUBLIC_ is inlined into the client bundle. Secrets are safe only in Server Components, Route Handlers, and Server Actions, and every Server Action is a public endpoint that must authenticate and authorize its caller.
Inlined at build time into browser JavaScript.
Available only in server code paths.
The build fails if a client component accidentally imports code that reads secrets.
Check the session and ownership in the action, not just in the UI that calls it.
Props are serialized into the page, so strip private fields first.
The value ships to every visitor.
Hidden fields still appear in the serialized payload.
Use RealComposer pipelines from client components or ISR pages for third-party aggregation, so preview tokens and upstream keys stay in the vault rather than in Next.js env files.
No. They are reachable by direct POST requests, so each one must validate input and check authorization.
The Supabase service_role key bypasses all Row Level Security (RLS) rules. If leaked, an attacker has unrestricted admin access to your database. RealComposer keeps your service role key in the Secret Vault and exposes locked-down endpoints with strict output filtering.
You should not store Firebase credentials in Next.js / React client code. Store service account JSON in Vault; Next.js routes call RealComposer instead of Firebase Admin SDK in serverless bundles. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Contentful credentials in Next.js / React client code. Edge injects preview token; ISR pages fetch composed CMS JSON safely. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
You should not store Anthropic credentials in Next.js / React client code. Next.js client chat UI calls edge stream; Anthropic never touches browser. RealComposer Secret Vault injects headers on Cloudflare Workers so only your edge URL is public.
To stitch contentful entries with shopify products api, use one RealComposer pipeline with parallel steps. Contentful marketing fields plus Shopify SKU inventory in parallel. Your Next.js / React app makes one request instead of several sequential upstream calls.
To merge cloudinary assets with contentful entries, use one RealComposer pipeline with parallel steps. Resolve Contentful asset references with Cloudinary transformation metadata. Your Next.js / React app makes one request instead of several sequential upstream calls.
Backend for Frontend (BFF) is an architectural pattern where a dedicated gateway layer is created for a specific frontend client (e.g., iOS, Android, React). Instead of clients calling multiple generic backend APIs, the edge BFF aggregates upstream calls, injects credentials, and strips unneeded payload fields before transmission.
Credential LeakageCredential leakage is the unintended exposure of secrets such as API keys, tokens, and passwords. Common sources include JavaScript bundles, decompiled mobile apps, public Git repositories, browser network logs, and low-code platform configurations visible to users.
Serverless FunctionsServerless functions are small units of code that run on demand in response to events such as HTTP requests, with the cloud provider handling servers, scaling, and patching. You pay per invocation rather than for idle capacity, and functions scale to zero when unused.