Only variables prefixed with `NEXT_PUBLIC_` are exposed to the browser bundle. Variables without that prefix are server-only. Rule of thumb: never put secrets (API keys, DB passwords) into `NEXT_PUBLIC_` variables.