I have a website hosted on Netlify where I set certain environment variables in the build & deploy tab. To access them in my React application I can do the following:
const someId = process.env.REACT_APP_SOME_ID;
const otherId = process.env.REACT_APP_OTHER_ID;
But how does process.env get its values? Is it an object in the global context or do they somehow get resovled in real-time? If not, how does using environment variables make it harder for an attacker to get sensitive data? They could simply call process.env.<whatever> in the console to get all data.
At what point do these variables receive their values? Could that even depend on the host?