Tudo no seu bundle é público.

# Anything with these prefixes is INLINED INTO THE BUNDLE at build
# time. Not read at runtime, not kept on the server: pasted into a
# file anyone can download. A secret here is a published secret.

NEXT_PUBLIC_*      # Next.js
VITE_*             # Vite, so also most Lovable and Bolt output
PUBLIC_*           # Astro, SvelteKit
REACT_APP_*        # Create React App
EXPO_PUBLIC_*      # Expo

# Server-only names have no prefix, and your host's secret store is
# where they belong:
SUPABASE_SERVICE_ROLE_KEY=...
STRIPE_SECRET_KEY=...
OPENAI_API_KEY=...

// app/api/summarise/route.ts
// The key stays on the server. The browser calls YOUR route, which
// is also the only place you can enforce who is allowed to ask.
import { NextResponse } from "next/server";

export async function POST(request: Request) {
  const session = await auth();
  if (!session) return NextResponse.json({ error: "sign in" }, { status: 401 });

  const answer = await fetch("https://api.openai.com/v1/responses", {
    method: "POST",
    headers: {
      authorization: `Bearer ${process.env.OPENAI_API_KEY}`,
      "content-type": "application/json",
    },
    body: JSON.stringify({ model: "gpt-5.4-mini", input: await request.text() }),
  });

  return NextResponse.json(await answer.json());
}

// supabase/functions/admin-task/index.ts
// service_role belongs here and nowhere else. Deno.env reads the
// function's own secrets, which are never bundled to a client.
import { createClient } from "jsr:@supabase/supabase-js";

const admin = createClient(
  Deno.env.get("SUPABASE_URL")!,
  Deno.env.get("SUPABASE_SERVICE_ROLE_KEY")!,
);

Deno.serve(async (request) => {
  const token = request.headers.get("authorization");
  if (!token) return new Response("unauthorized", { status: 401 });
  // Check who is asking BEFORE using a key that ignores every policy.
  const { data: user } = await admin.auth.getUser(token.replace("Bearer ", ""));
  if (!user) return new Response("unauthorized", { status: 401 });

  return Response.json({ ok: true });
});

1. Issue the new credential first, so nothing goes down.
2. Update your host's secret store and redeploy.
3. Revoke the old one. This is the step that actually helps, and
   the one people skip because everything already works without it.
4. Check the provider's audit log for use you cannot account for.
5. Search your git HISTORY, not just your files:
     git log -p -S 'sk_live_' -- . | head -50
   Deleting a key from a file leaves it in every clone of the repo.