Ah thanks for sharing the fix
There are two separate concerns here
- Vercel exposes those system environment variables to the running application
- Next.js keeps all environment variables server only and only sends down those explicitly marked NEXT_PUBLIC
So even if the Vercel docs say Vercel exposes those, you could be running any app or framework and it’s up to that app to decide what it sends to users