I am building a firebase application using React v17.0.2 that uses dotenv v8.2.0 to populate the firebaseConfig object.

When I run npm run build it bundles the scripts and puts it in the build folder (obviously) but I noticed that when I view the javascript file that was bundled in the build I can see all the dotenv values. This is a huge security risk as it contains the api key for the firebase app.

For clarity this is what the firebaseConfig variable looks like

const firebaseConfig = {
  apiKey: process.env.REACT_APP_API_KEY,
  authDomain: process.env.REACT_APP_AUTH_DOMAIN,
  databaseURL: process.env.REACT_APP_DATABASE_URL,
  projectId: process.env.REACT_APP_PROJECT_ID,
  storageBucket: process.env.REACT_APP_STORAGE_BUCKET,
  messagingSenderId: process.env.REACT_APP_MESSAGE_SENDING_ID,
  appId: process.env.REACT_APP_APP_ID
};

Is there a way to hide or encrypt these values?