[docs]: Clarify env variables are NOT "SECRET"

[JBallin]

The usage of REACT_APP_SECRET_CODE in Adding Custom Environment Variables is misleading given that there are no secrets in the front end.

Should I open a PR that changes all to REACT_APP_NOT_SECRET_CODE?

Also, should there be a warning box toward the top about being careful not to expose secrets?

[miraage]

During the build, process.env.REACT_APP_SECRET_CODE will be replaced with the current value of the REACT_APP_SECRET_CODE environment variable

Documentation says it explicitly, that this value will end up in the result bundle.

[JBallin]

@miraage I don't believe this makes it clear that secrets will be exposed. It requires some deduction and reading. Here's an example warning message:

Don't store any secrets (such as API keys) in your React app as they'll be included in the build (meaning they can be read by anyone looking at your script/html files in dev tools). Instead, you should send requests to a separate backend (which stores your secrets) and send back the response to your React app.

I think this is an important distinction that should be immediately obvious when looking at the docs, especially for beginners. Unfortunately some misinformation is being spread online, so I think it's safe to assume that people are not finding this clear.

What's the downside of adding NOT?

[stale]

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

[ianschmitz]

Would you like to submit a PR to update the docs @JBallin?

[JBallin]

@ianschmitz would love to! Was just waiting for agreement/feedback on the following:

1. Changing all to REACT_APP_NOT_SECRET_CODE
2. Adding a warning at the top about secrets
3. The following warning message:

Don't store any secrets (such as API keys) in your React app as they'll be included in the build (meaning they can be read by anyone looking at your script/html files in dev tools). Instead, you should send requests to a separate backend (which stores your secrets) and send back the response to your React app.

[ianschmitz]

Sounds reasonable. Let's get a PR going and we can get some feedback from the others in there. Thanks!

[stale]

This issue has been automatically marked as stale because it has not had any recent activity. It will be closed in 5 days if no further activity occurs.

[JBallin]

There's an open PR in progress: #6062