NEXT_PUBLIC_ leaked your github token into the App Router bundle

Why Next.js does this

A server component can read `process.env.STRIPE_SECRET_KEY` safely. Move that same line into a client component and the build fails to find it, so the quickest fix — rename it with `NEXT_PUBLIC_` — is also the one that inlines it into the JavaScript every visitor downloads.

Confirm it first

Before rotating anything, check whether the key is actually being served. Paste your deployed URL — KeyDrift downloads the same JavaScript a visitor gets and tells you what is in it.

Rotate the key

Do this before changing any code. The key has been served to browsers, cached by CDNs and very likely scraped already — removing it from the source does not un-publish it.

1. 1Revoke the token in Settings → Developer settings → Personal access tokens.
2. 2Check the account’s security log for pushes, clones and workflow runs you did not make.
3. 3Re-issue as a fine-grained token scoped to the one repository that needs it.

Move the call to a server

The replacement key must not follow the old one into the bundle, which means the code that uses it cannot live in the browser. Any variable named NEXT_PUBLIC_… is inlined at build time by design — the prefix is the mechanism, not a mistake.

// app/components/Chat.tsx  ("use client")
// NEXT_PUBLIC_ inlines this into the browser bundle.
const key = process.env.NEXT_PUBLIC_API_KEY;
const result = await callTheApi(key, body);

// app/api/proxy/route.ts  — runs on the server only
import 'server-only';

export async function POST(request: Request) {
  const key = process.env.API_KEY; // no NEXT_PUBLIC_ prefix
  const result = await callTheApi(key, body);
  return Response.json(result);
}

// app/components/Chat.tsx  ("use client")
const result = await fetch('/api/proxy', { method: 'POST' }).then((r) => r.json());

How KeyDrift detects it

Matches the `ghp_`, `gho_`, `ghu_`, `ghs_` and `ghr_` prefixes. A classic personal access token usually carries every private repository the user can see.