A Next.js app's .env has NEXT_PUBLIC_STRIPE_KEY and STRIPE_SECRET_KEY. Which statement is true?

At build time, Next.js replaces every process.env.NEXT_PUBLIC_... in client code with its value. The value is then plain text in the bundle. Without the prefix, a variable stays on the server. Client code that reads it just gets undefined. So only put keys meant to be public, like Stripe's publishable key, behind NEXT_PUBLIC_.

"Both stay secret, because .env is never sent" is the tempting wrong answer. The file isn't sent, but NEXT_PUBLIC_ values are copied into the JavaScript. "Fetched at runtime" is wrong. They are fixed at build time, so changing one needs a rebuild.