Your runtime environment variables are not safe.

Just this code in an npm package would leak them to a malicious endpoint.

So, where should you store your secrets?

Source: x.com/mattpocockuk/status/1842146649734324625