Django dev server request.META has all my env vars
I just ran into this as well which caught me by surprise, I thought my page was sending all my env variables to the server.  I use the env to store credentials so I was concerned.
Any application running in your environment has access to your env variables, therefore the server has access to your env variables.  Bottom line the browser is not sending all your env variables to the server.  The request object is built on the server side.
Why do I see all my environment variables in request.META when using the dev server?