Nuxt · NUXT0054
Do not expose secrets in runtimeConfig.public
Flags secret in public config in Nuxt runtime code before it leaks into runtime behavior.
nuxt/runtime/no-secret-in-public-configsrc/rule-packs/nuxt/rules/nuxt/no-secret-in-public-config.ts Upstream docs Run this rule
pnpm nuxt doctor --rules nuxt/runtime/no-secret-in-public-config
Why it matters
Secrets that reach public runtime config or client bundles can be exposed to every visitor and crawler.
Recommended fix
Move secrets to private runtimeConfig and read them only on the server.
Useful links
Example
Avoid secret in public config
Before
export default defineNuxtConfig({
runtimeConfig: {
public: { apiSecret: process.env.API_SECRET },
},
})
After
export default defineNuxtConfig({
runtimeConfig: {
apiSecret: process.env.API_SECRET,
public: { apiBase: '/api' },
},
})