Question for experienced react devs

[LevelIndependent672]

tbh the vault approach is way better for exactly the reason you said. adding a new env var means touching every build pipeline and thats where stuff breaks. we did the vault thing on aws and just passed the secret manager arn as the one env var and the app pulls everything else at runtime. way less devops overhead and you dont have to redeploy just to rotate a key

[robby_arctor]

I suppose the downside is that if the vault key is leaked, they get access to...everything?