In Next.js, environment variables are defined in .env files. Only those whose name starts with NEXT_PUBLIC_ are built into the code sent to the browser, and are therefore public. The others stay on the server and may contain secrets. Local files are not committed.
Example
NEXT_PUBLIC_API_URL=https://api.exemple.org
DATABASE_URL=postgres://...