react-doctor/public-env-secret-name

A public-prefixed env var whose name implies a secret (token, password, private key, service role) is inlined into the client bundle, so a real credential there is world-readable.

Validation prompt

Confirm the detector match and collect the required evidence before deciding whether an edit is warranted.

Fires in client (browser-bundled) code when a public-prefixed env var: NEXT_PUBLIC_, VITE_, REACT_APP_, or EXPO_PUBLIC_: has a NAME containing SECRET, TOKEN, PASSWORD, PRIVATE, DATABASE_URL, SERVICE_ROLE, AWS_ACCESS_KEY, or AWS_SECRET. It reports the first such name that is NOT on the trusted-public allowlist (Sentry DSN, *PUBLISHABLE*, Supabase ANON_KEY, PostHog/Mixpanel/Mapbox tokens, Algolia search key, Google Maps key, *PUBLIC_KEY*, and *_(DISABLE|ENABLE|ALLOW|REQUIRE)_* feature flags). Matching is name-only: it never inspects the value.

Suppress when: a value that is genuinely client-safe despite a scary name: a vendor's designated publishable/anon token not yet allowlisted, or a boolean flag like NEXT_PUBLIC_ENABLE_SECRET_MENU; confirm only when the name denotes a real credential that would be inlined into the bundle.

Evidence boundary

The diagnostic proves only that the detector’s modeled source pattern matched. It does not prove runtime impact, product intent, rendered failure, or that one remediation is correct.

Establish the environment, repository policy, exceptions, and required rendered or runtime evidence before deciding the occurrence.

Record one outcome:

• Confirmed failure: The required evidence establishes the violation.
• Rejected: A documented exception or false-positive predicate applies.
• Needs evidence: Named evidence can still be collected.
• Unavailable: Required evidence cannot be collected in this run.
• Waived with evidence: An authorized, scoped exception applies to an established failure.
• Observation: The review records an optional tradeoff without claiming a defect.

A waiver records its scope, authority, evidence, and review condition. It is not a pass or false positive.

Default severity is registry metadata. Use the occurrence’s JSON severity after repository configuration when ordering real findings.

Fix prompt

Apply this candidate correction only after the required evidence confirms the risk.

If it is a real credential, move it to a server-only env var (drop the public prefix) and read it from server code or a backend route, because every NEXT_PUBLIC_/VITE_/REACT_APP_/EXPO_PUBLIC_ value is embedded in client JavaScript. Rotate it if it ever shipped in a bundle. If the value is genuinely public, rename it to a non-secret form (for example *_PUBLISHABLE_KEY, *_ANON_KEY) so it stops tripping the check.

Repository-wide copy prompt

Use this repository-wide prompt only after validating each occurrence. For one occurrence, use the guidance above.