Vite · VITE0005
Do not expose secrets through Vite define
Flags secret define in Vite define code before it leaks into runtime behavior.
Run this rule
pnpm vite-doctor . --framework vite --rules vite/define/no-secret-define
Why it matters
Secrets that reach public runtime config or client bundles can be exposed to every visitor and crawler.
Recommended fix
Remove secret define, or move it to the Vite runtime/API that owns that behavior.
Useful links
Example
Keep secrets out of define
Before
export default defineConfig({
define: {
__API_SECRET__: JSON.stringify(process.env.API_SECRET),
},
})
After
export default defineConfig({
define: {
__PUBLIC_VERSION__: JSON.stringify(process.env.npm_package_version),
},
})