Vite app security: what to check
Vite builds the front end of many apps made with AI tools, including Lovable and Bolt apps. A Vite build is a set of static files, so everything in it is public, and the host decides which headers are sent.
Every environment variable whose name starts with VITE_ is written into those files.
What to check on Vite
-
Are secret API keys exposed in your front end?
A secret given the VITE_ prefix is built into the public bundle.
-
Which services and settings does your app expose?
Lists the VITE_ variable names and services visible in your build.
-
Is your site publishing its source maps?
Vite only publishes source maps when build.sourcemap is switched on; check it is off for production.
-
Did development leftovers ship to production?
Spots the Vite development server or development builds left in a published site.
-
Are your security headers set?
Set by your host: a _headers file on Netlify or Cloudflare Pages, vercel.json on Vercel.
Where settings go on Vite
- Security headers
- A Vite build is static, so headers are set by your host: a _headers file on Netlify or Cloudflare Pages, vercel.json on Vercel, or your web server configuration.
- Secret keys
- Variables starting with VITE_ are built into the public bundle. Keep the key in a server-side function (for example a Supabase Edge Function or a Netlify or Vercel function) and read it from an environment variable without the VITE_ prefix.
Common questions
Are VITE_ environment variables secret?
No. Vite writes every VITE_ variable into the built files. Keep secrets in a server-side function without that prefix.
Does Vite publish source maps?
Only if build.sourcemap is switched on in your Vite configuration.