The NEXT_PUBLIC_MAPBOX_TOKEN environment variable is intentionally exposed to the client-side code. This is the correct implementation for Mapbox GL JS and is expected behavior.

Mapbox tokens are designed to be public and used in client-side applications. They are not sensitive secrets like database passwords or API keys for server-side services.

To properly secure your Mapbox token:

1. URL Restrictions: In your Mapbox account dashboard, restrict the token to specific URLs:

   • http://localhost:* (for development)
   • https://yourdomain.com (for production)

2. Scope Restrictions: Limit the token to only the APIs you need:

   • Maps API (required)
   • Geocoding API (required for address lookup)
   • Disable other APIs you don't use

3. Token Rotation: Regularly rotate your tokens and update them in your environment variables.

1. Go to your Vercel project settings
2. Navigate to Environment Variables
3. Add NEXT_PUBLIC_MAPBOX_TOKEN with your Mapbox public token
4. The NEXT_PUBLIC_ prefix is required for client-side access in Next.js

The following API keys should remain server-side only:

• ASSEMBLYAI_API_KEY - Used only in the Python transcription service
• OPENWEATHER_API_KEY - Used only in the weather service
• Redis connection details - Used only in backend services

1. Never commit API keys to version control
2. Use different tokens for development and production
3. Monitor token usage in your provider dashboards
4. Set up alerts for unusual API usage
5. Regularly audit and rotate API keys

If you discover a security vulnerability, please report it to the project maintainers privately.