why exported variable in *.server.js exposed to client?

[tsulatsitamim]

based on docs

auth.server.js
// This would expose secrets on the client
export const JWT_SECRET = process.env.JWT_SECRET;

[brookslybrand]

It's just an example

Exporting it from a *.server.* file mean that that secret can never be read from the client.

If you weren't using a *.server.* module, and exporting a secret like that, it would be unsafe as it would be exposed on the client

[tsulatsitamim]

why the docs say: This would expose secrets on the client when exported from auth.server.js

[brookslybrand]

It's saying "this would expose secrets on the client if it were exported from a non-.server module`". I can update the language in the doc