Find the bug

There's a vulnerability in this code. You have 10 seconds. Can you find it?

Hint: this code runs in the browser.

In short

In Next.js, any value starting with NEXT_PUBLIC_ is embedded in the code sent to the browser, so anyone visiting your site can read that key. Keep secret keys without NEXT_PUBLIC_ and make the request from the server.

Today's script

There's a vulnerability in this code. You have 10 seconds. Can you find it? Hint: this code runs in the browser. Answer: line two. Every value that starts with NEXT_PUBLIC_ gets baked into the code sent to the browser. So anyone can read your key just by opening your site. The fix: store the key without NEXT_PUBLIC_ and let the server make the request. Open DevTools on your own site and search for the start of your key. If it shows up, change the key right away. Tomorrow: you clicked the wrong link. What do you do in the first 10 minutes?