Does dotenv-webpack expose all environment variables from .env to front end?

Question

I am building an application that has public keys for some APIs and private keys for other APIs. I would like to store all of them inside of my single .env file and use dotenv to provide the private keys to my server and dotenv-webpack to provide the public keys to my public front-end javascript. Will using this package make my private keys available in my javascript or will it only take the ones it needs?

Example:

# .env file
public_key="12345"
private_key="45678"

This one needs to be accessed on the fron end

// javascript file on front end
var publicKey = process.env.public_key

But I would like to keep this one hidden

// javascript file in node.js
var privateKey = process.env.private_key

The package I am considering using is this one: https://www.npmjs.com/package/dotenv-webpack

Answer 1

The github page of the plugin states that:

dotenv-webpack wraps dotenv and Webpack.DefinePlugin. As such, it overwrites existing any existing DefinePlugin configurations. Also, like DefinePlugin, it does a text replace in the resulting bundle for any instances of process.env.

Your .env files can include sensitive information. Because of this,dotenv-webpack will only include defined environment variables in the final bundle.

So its safe. It will only expose the environment variables which you actually use in the code.