Short answer: no. In a Vite app, every environment variable that starts with VITE_ is written into your JavaScript bundle at build time. That bundle is downloaded by every visitor, so anyone can read the value in DevTools.

The same is true of NEXT_PUBLIC_ in Next.js and REACT_APP_ in Create React App.

Why the prefix exists

Vite hides variables without the VITE_ prefix from your frontend code on purpose. The prefix is how you tell Vite "this value is safe to publish".

Here's how secret keys usually end up public in AI-built apps:

The AI tool writes import.meta.env.OPENAI_API_KEY .

It's undefined in the browser, so the feature breaks.

The "fix" is to rename it to VITE_OPENAI_API_KEY .

The feature works, and the key now ships to every visitor.

Lovable, Bolt and most Cursor-built frontends are Vite apps, so this comes up a lot.

Fine in a VITE_ variable

Your Supabase URL and anon (or sb_publishable_ ) key, as long as Row Level Security is on for every table

Stripe publishable keys ( pk_live_ ,…