Vite · VITE0008

Avoid broad Vite env prefixes

Keep Vite client env prefixes narrow enough to avoid accidental exposure.
VITE0008vite-doctor/vitesecuritywarnNo fix

Run this rule

pnpm vite-doctor . --framework vite --rules vite/env/no-broad-env-prefix

Why it matters

Every matching prefix exposes environment variables to client code through import.meta.env, so broad prefixes can publish unrelated configuration.

Remove broad env prefix, or move it to the Vite runtime/API that owns that behavior.

Example

Use narrow env prefixes

Before

export default defineConfig({
  envPrefix: ['VITE_', 'APP_'],
})

After

export default defineConfig({
  envPrefix: ['VITE_PUBLIC_'],
})
Copyright © 2026