Static public environment variables (PUBLIC_ prefix) replaced at build time, safe for client-side exposure