I am accessing the environment variables at run time through defining a js file as a placeholder and running a shell script that replaces the js content with the actual environment variables.
These values are stored in the window object and are not secure.
Since the js file is served from the ngnix root folder, anyone can access with https://application_url/javasceipt_file.js

How can I secure this data from exposing to end user either by hitting the url or teh file being exposed to sources in browser when the application is loaded.
I am following the below links
https://create-react-app.dev/docs/title-and-meta-tags/#injecting-data-from-the-server-into-the-page
https://javaadpatel.com/building-and-deploying-react-containers/
https://www.codecentric.de/wissens-hub/blog/react-application-container-environment-aware-kubernetes-deployment

I have tried to read these runtime environment variables served through kubernetes cluster through docker file as below
ARG REACT_APP_ENV_VAR
ENV REACT_APP_ENV_VAR=$REACT_APP_ENV_VAR

But these values are not injected to read as process.env.REACT_APP_ENV_VAR as these are not available at build time.