Migrating to Nuxt 3 runtimeConfig: which keys silently become public?

Context

While migrating a Nuxt 2 application (which used publicRuntimeConfig and privateRuntimeConfig) to Nuxt 3's unified runtimeConfig, I need to guarantee that no secret values accidentally cross into the client bundle. My understanding is that only keys under runtimeConfig.public are serialized to the browser, while top-level keys stay server-only.

Constraints

The deployment pipeline injects configuration through environment variables, and I have seen references to NUXT_ and NUXT_PUBLIC_ prefix conventions for overrides. This raises a concern: an ops-side variable named with the public prefix could push a credential to the client without any code change. The team also has no auditing convention for which keys are public, and Nuxt does not appear to warn at build time when a secret-looking value sits under public.

Questions

1. Is inspecting window.__NUXT__ and grepping .output/public after a build a reliable way to verify which runtimeConfig values actually reach the browser?
2. Does the NUXT_PUBLIC_* environment override apply even when the corresponding key is not declared under runtimeConfig.public in nuxt.config?
3. Is there an established convention or lint-style check teams use to flag credential-named keys placed under public?