Environment variables are handled differently depending on when they are injected:
- Build-time: Variables are statically injected into the bundle during the build process (e.g.,
import.meta.env.VITE_...). Once the static files are generated, changing the .env file will not affect the deployed application without a rebuild. - Runtime: Variables are read when the application starts or the page loads (e.g., server-side
process.env or frontend via window.__APP_CONFIG__). This allows configuration changes after deployment without rebuilding the code.
Security Warning: Any variable exposed to the frontend (browser) is public. Never put secrets, private keys, or sensitive tokens in frontend environment variables.