config-and-security
Installation
SKILL.md
Next.js 16 — Configuration and Security
This skill covers env vars (and how to keep secrets out of the client bundle), proxy.ts (which replaces middleware.ts in Next.js 16), and the security review you should run before shipping any Next.js app.
Environment variables
The two flavors
| Prefix | Available in | Example |
|---|---|---|
NEXT_PUBLIC_ |
Server and client (inlined into the JS bundle at build time) | NEXT_PUBLIC_API_URL |
| no prefix | Server only | SWAG_BYPASS_TOKEN, DATABASE_URL |
This is the most important rule: anything in NEXT_PUBLIC_* is shipped to every visitor's browser. Do not put secrets there. Ever.