I mean the admin account had visibility of clients env vars, thats maybe not really great in the first place.

you'd think. but this is a js dev world.

nextjs app bake all env vars on the client side code!! it's all public, unless you prefix the name with private_ or something.