Unexpected client-side exposure of Nuxt runtimeConfig values

When auditing a Nuxt 3 application, some configuration entries that were intended for server‑only use appear in the generated client bundle, suggesting they are being treated as public runtime config.

The goal is to understand why values without the NUXT_PUBLIC_ prefix are being included in the client‑side JavaScript and to confirm whether they are actually exposed to end users.

Constraints include the project’s use of the runtimeConfig API, the absence of any build‑time warnings, and the need to avoid exposing secrets such as API keys or tokens.

What causes non‑prefixed config keys to be bundled into the client payload?
How can developers verify which keys are marked as public at build time without manually inspecting the bundle?
Are there any linting or build‑time checks that can prevent accidental inclusion of server‑only values in runtimeConfig.public?