Most beginners who learn full stack JavaScript today do not get stuck on syntax, because AI tools write the syntax. They get stuck on where the code runs, who can call it, and what the free plans allow.

The five mistakes below all sit in that gap. Each one is easy to make when AI writes most of your code. Each one is also easy to avoid once you know it exists.

Mistake 1: Putting a secret key where the browser can see it

In a Next.js app, any environment variable whose name starts with NEXT_PUBLIC_ is copied into the JavaScript that goes to every visitor. Variables without that prefix stay on the server.

So if an AI tool suggests renaming SUPABASE_SECRET_KEY to NEXT_PUBLIC_SUPABASE_SECRET_KEY to make an error go away, say no. The error will go away, and your secret will be public.

Supabase is clear about this. Its secret key should never go in a browser, a shipped app or source control.…