nextjs-env-variables
Manages Next.js environment variables with file precedence and deployment configurations for seamless application setup.
Install this skill
Security score
The nextjs-env-variables skill was audited on Mar 1, 2026 and we found 49 security issues across 2 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Access to .env file
| 18 | ├── .env # Shared defaults (committed) |
Access to .env file
| 19 | ├── .env.local # Local secrets (gitignored) |
Access to .env file
| 20 | ├── .env.development # Development defaults (committed) |
Access to .env file
| 21 | ├── .env.development.local # Local dev overrides (gitignored) |
Access to .env file
| 22 | ├── .env.production # Production defaults (committed) |
Access to .env file
| 23 | ├── .env.production.local # Production secrets (gitignored) |
Access to .env file
| 24 | ├── .env.test # Test environment (committed) |
Access to .env file
| 25 | └── .env.example # Documentation (committed) |
Access to .env file
| 32 | 1. `.env.$(NODE_ENV).local` (e.g., `.env.production.local`) |
Access to .env file
| 33 | 2. `.env.local` (not loaded in test environment) |
Access to .env file
| 34 | 3. `.env.$(NODE_ENV)` (e.g., `.env.production`) |
Access to .env file
| 35 | 4. `.env` |
Access to .env file
| 37 | **Example**: In production, if `DATABASE_URL` is defined in both `.env` and `.env.production.local`, the value from `.env.production.local` wins. |
Access to .env file
| 46 | # .env.local |
Access to .env file
| 56 | const apiUrl = process.env.NEXT_PUBLIC_API_URL; |
Access to .env file
| 60 | return <div>API: {process.env.NEXT_PUBLIC_API_URL}</div>; |
Access to .env file
| 79 | # .env.local |
Access to .env file
| 90 | const dbUrl = process.env.DATABASE_URL; |
Access to .env file
| 96 | const secret = process.env.JWT_SECRET; |
Access to .env file
| 102 | const dbUrl = process.env.DATABASE_URL; // undefined! |
Access to .env file
| 108 | ### .env (Committed - Shared Defaults) |
Access to .env file
| 115 | # Database (overridden in .env.local) |
Access to .env file
| 122 | ### .env.local (Gitignored - Local Secrets) |
Access to .env file
| 134 | ### .env.production (Committed - Production Defaults) |
Access to .env file
| 146 | ### .env.example (Committed - Documentation) |
Access to .env file
| 149 | # Copy this to .env.local and fill in actual values |
Access to .env file
| 171 | # Development (.env.local) |
Access to .env file
| 234 | python scripts/validate_env.py .env.local --framework nextjs |
Access to .env file
| 236 | # Compare with .env.example |
Access to .env file
| 237 | python scripts/validate_env.py .env.local --compare-with .env.example |
Access to .env file
| 246 | # List all .env files |
Access to .env file
| 247 | ls -la .env* |
Access to .env file
| 250 | for file in .env*; do |
Access to .env file
| 273 | **Symptom**: `process.env.MY_VAR` is `undefined` in component. |
Access to .env file
| 297 | **Symptom**: App works with `.env.local`, fails in production. |
Access to .env file
| 299 | **Solution**: Ensure all variables from `.env.local` are set in Vercel: |
Access to .env file
| 310 | - [ ] `.env.local` in `.gitignore` |
Access to .env file
| 311 | - [ ] `.env.*.local` in `.gitignore` |
Access to .env file
| 313 | - [ ] No `.env` files committed with real secrets |
Access to .env file
| 314 | - [ ] `.env.example` has structure, not actual values |
External URL reference
| 47 | NEXT_PUBLIC_API_URL=https://api.example.com |
External URL reference
| 131 | NEXT_PUBLIC_API_URL=http://localhost:4000/api |
External URL reference
| 138 | NEXT_PUBLIC_API_URL=https://api.production.com |
External URL reference
| 152 | NEXT_PUBLIC_API_URL=https://api.example.com |
External URL reference
| 212 | NEXT_PUBLIC_API_URL=https://api.example.com # ✅ Exposed to browser |
External URL reference
| 279 | API_URL=https://api.example.com |
External URL reference
| 282 | NEXT_PUBLIC_API_URL=https://api.example.com |
External URL reference
| 319 | - [Next.js Environment Variables Documentation](https://nextjs.org/docs/basic-features/environment-variables) |
External URL reference
| 320 | - [Vercel Environment Variables](https://vercel.com/docs/environment-variables) |
Install this skill with one command
/learn @macphobos/toolchains-javascript-frameworks-nextjs