Env variables shouldn't get revealed in the bundled js file

[harshnambiar]

Feature request

Make webpack compiled env variables end-user safe

What is the expected behavior?
Currently, any process.env variable gets shown "as it is" in the compiled bundled.js.

What is motivation or use case for adding/changing the behavior?
This clearly defeats the purpose of having environmental variables, because anyone can see the data by analyzing the js file.

How should this be implemented in your opinion?
Instead of being added to the bundled.js file, an env file should be generated at runtime called bundled.env, also to be placed in the dist folder, and in such a way that end users aren't able to access the values to the env variables.

Are you willing to work on this yourself?
it's beyond my paygrade, sorry

[alexander-akait]

Sorry, it is non standard, you can create a plugin for this

[alexander-akait]

Also you should not store sensitive data in your bundle, it is unsafe, even using bundled.env