Secrets manager failing build?

Support
1

Hello, I am currently building a website on bolt.new, exporting to github and deploying through netlify so I can use functions, etc.

I have all of my env variables set through netlify- none in my code. I have attempted any env processing calls to netlify functions, however, my API keys are still being leaked into my build folder.

Even API keys that I do not have set to be processed inside of my code is being logged into my dist/assets html files.

Basically, every env file I have configured as a secret is being published to my build… even though I don’t reference a few of them. Why is this?

Thank you.

2

Update; I have figured out that it was leaking them as my ENV files had the prefix “VITE_”

However, now it is only the env variables that are processed within my code that is leaked. Help! Lol.

3

SOLVED!

For users experiencing this issue- first, view my above text.
Secondly, ensure that you are not using process.env in any file in your front-end code.
Pass every instance where you must use your secret credentials to your netlify functions

Saying this now, I feel braindead. But a few overlooked files in a large project will completely throw your security off!

Cheers!

1 Like