That's essentially what NEXT_PUBLIC_ is for... but serializing process.env is a new one for me.

They don’t serialize process.env, but devs will take config values from environment variables. Obviously you’re not supposed to do this but it’s a footgun.