[theoephraim]

The docs implied @dynamic keeps a public value more contained, but it does the opposite: static public values only reach the browser where client code references them, while the public env endpoint and boot-time injection send every public+dynamic key by default.

• Static vs dynamic guide: correct the "use it freely" guidance, call out that getPublicDynamicEnv() with no args serves every public+dynamic key, and show how to narrow the boot-injection filter
• @sensitive / @public reference: say plainly that public means it may be sent to the browser, and that server-only values should stay sensitive (with redact=false if they are not secret)
• Astro / Nuxt: note the auto-injected route serves every public+dynamic key, and how to replace it with a scoped route

Refs #1254

[pullfrog]

✅ No new issues found.

Reviewed changes: Reviewed all four documentation changes against the runtime helpers, framework endpoint implementations, and CLI filter semantics.

• Exposure guidance: Clarifies that @dynamic changes build-time handling, not visibility, and that unscoped endpoints and boot injection expose all public+dynamic values.
• Scoped payloads: Documents explicit key lists, safe boot-injection filtering, and replacing Astro/Nuxt automatic endpoints with scoped routes.
• Server-only values: Explains the public/sensitive distinction and using redact=false when sensitive values should remain visible in logs.

  ^{｜ View workflow run ｜ Using gpt-6.1-sol ｜ 𝕏}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	varlock-website	d94b6f9	Commit Preview URL Branch Preview URL	Oct 29 2026, 06:45 AM