how can i protect my data?

When dealing with environment variables, you have to point to the file where the variables are stored.

By default Gatsby supports 2 environments:

• Development. If you run gatsby develop, then you will be in the “development” environment.
• Production. If you run gatsby build or gatsby serve, then you will be in the “production” environment.

In your case, besides adding the following snippet in your gatsby-config.js (above the exportation) you just need to create a .env.development and .env.production in the root of your project.

require(`dotenv`).config({
  path: `.env.${process.env.NODE_ENV}`,
});


module.exports = {
  siteMetadata: {
  // your metadata
  },
  plugins: [
  // your plugins
  ],
}

Then, in your .env.development/.env.production:

CONTENTFUL_SPACE_ID= "yourSpaceId"
CONTENTFUL_ACCESS_TOKEN= "yourAccesToken"

You can customize this behavior to change the environment file where the variables are stored if needed.