[Wave 200pts] Audit all NEXT_PUBLIC_* environment variables for accidental sensitive-value exposure

[portableDD]

Summary

No documented audit currently confirms that every NEXT_PUBLIC_*-prefixed environment variable in this codebase (which Next.js bundles directly into the client-side JavaScript, visible to anyone) is genuinely safe to expose — this is worth explicitly verifying rather than assuming, given the app's mix of API keys (e.g. MoonPay) and other configuration.

Why This Matters

NEXT_PUBLIC_* variables are, by design, fully visible in the shipped client bundle; any variable under this prefix that was intended to stay server-only, even by accident, is effectively a public leak the moment it's built — this deserves an explicit, documented audit rather than an assumption of correctness.

What Needs to Be Done

• Enumerate every NEXT_PUBLIC_* environment variable referenced anywhere in the codebase
• For each, confirm it is genuinely safe for full public/client exposure (e.g. a publishable API key by design, not a secret key)
• Document the audit's findings, and file any discovered issue as a separate, appropriately-prioritized fix rather than silently correcting it without a paper trail

Key Files

• .env.example
• next.config.ts

Acceptance Criteria

• Every NEXT_PUBLIC_* variable in the codebase is confirmed safe for public exposure, or a follow-up fix is filed for any that isn't
• The audit's findings are documented
• Complexity: 200 points