Because DataSource's in elm-pages never run in the browser (see the DataSource docs), you can access environment variables securely. As long as the environment variable isn't sent down into the final Data value, it won't end up in the client!

import DataSource exposing (DataSource)
import DataSource.Env


type alias EnvVariables =
    { sendGridKey : String
    , siteUrl : String
    }


sendEmail : Email -> DataSource ()
sendEmail email =
    DataSource.map2 EnvVariables
        (DataSource.Env.expect "SEND_GRID_KEY")
        (DataSource.Env.get "BASE_URL"
            |> DataSource.map (Maybe.withDefault "http://localhost:1234")
        )
        |> DataSource.andThen (sendEmailDataSource email)


sendEmailDataSource : Email -> EnvVariables -> DataSource ()
sendEmailDataSource email envVariables =
    Debug.todo "Not defined here"