Unit III · Going live
Settings, secrets and debug mode
Configuration is everything that changes between your laptop and the live site. Two mistakes cause many leaks: secrets that end up in browser code, and debug mode left on in production.
Environment variables and .env
Settings such as database passwords and API keys are usually given to the app as environment variables, often loaded from a .env file that stays out of the repository. The live server gets its own values, set on the server or in the host's dashboard.
Some variables are sent to the browser
Front-end build tools copy certain variables into the code they ship to browsers. Vite exposes only variables whose names start with VITE_ to your client code; Next.js inlines variables that start with NEXT_PUBLIC_ into the browser bundle. Anything with such a prefix is public, so never give a secret one of those names.
Debug mode is for your laptop
Debug or development mode shows detailed error pages with file paths, code and settings. Django's documentation is blunt: never deploy a site into production with DEBUG turned on. Most frameworks have the same switch. Production should show a plain error page and write the details to a log only you can read.
Words to know
- Environment variable
- a named setting given to a program by the system it runs on
- .env file
- a local file of such settings, kept out of the repository
- Debug mode
- detailed error output meant for developers
- Public prefix
- a variable-name pattern that lets the build tool ship the value to browsers
Sources
Checked October 17, 2026. Pages on other sites change; if a source no longer says what the lesson says, the source wins.