you'd think. but this is a js dev world.

nextjs app bake all env vars on the client side code!! it's all public, unless you prefix the name with private_ or something.

This is incorrect.

You preface with PUBLIC_ to expose them in client side code.