CS Fundamentals Trainer · JavaScript · Security

A Vite app reads import.meta.env.VITE_PAYMENT_SECRET in a component. After vite build, where does the secret's value end up?

A Vite app reads `import.meta.env.VITE_PAYMENT_SECRET` in a component. After `vite build`, where does the secret's value end up?

  1. In a server-side env file that the browser fetches with the user's session
  2. Inlined as a plain string in the JavaScript files served to every visitor
  3. Encrypted in the bundle and decrypted at runtime with a key from the build
  4. Nowhere, because Vite strips variables whose names contain `SECRET`

Difficulty: easy

Answer this question

Related questions