If your frontend reads an AI or payments key from import.meta.env.VITE_SOMETHING , that key is in the JavaScript bundle every visitor downloads. Same for NEXT_PUBLIC_* in Next.js and REACT_APP_* in Create React App. Putting it in a .env file changes where it's stored on your laptop, not where it ends up.

You can check in ten seconds: open your deployed site, open DevTools → Sources, and search the bundle for your key's prefix ( sk- , AIza , sk_live_ ).

What happens after a key ships in a bundle

Automated scanners crawl deployed sites and public repos for those prefixes.…