Next.JS security of directory structure and JSON secrets

Question

I have a security question regarding the access of Next.JS directories, and their access requirements.
I have a root folder that has my pages, public, src, styles, models folders.

In the src folder I have a settings.json file that is a empty JavaScript object. The idea is that settings would be added to this file and accessed by api routes, to check settings that could be modified on this settings.json file...
What I am wondering is if the client can actually somehow just read/access the src directory and get the settings.json file.
I want to put secret key's here that way I can easily change secret keys without having to restart my server. So I could just update the secret key live, and have it applied to the settings.json file. Then the update would be live immediately and I don't have to change the environment variables and restart the server.
Is it safe to keep and use a json file in the src directory to store confidential data? If not, is there a way to keep and use a json file for this purpose? Thanks for the help and info.