GoogleMap のAPI_KEYが見えてしまう

ソースの表示
<script async defer src="https://maps.googleapis.com/maps/api/js?key=ここにAPI_KEYがそのまま表示されてしまう&callback=initMap"></script>

インストールされているgem
gem 'kaminari'
gem 'gon'
gem 'geocoder'
gem 'dotenv-rails'
gem 'gmaps4rails'
gem 'mini_racer'
gem "dockerfile-rails", ">= 1.0", :group => :development
gem "pg", "~> 1.4"

/index.html.erbの記述（一部）

<style>
#map {
  height: 600px;
  width: 500px;
}
</style>

<%= javascript_include_tag 'users.js' %>
<script async defer src="https://maps.googleapis.com/maps/api/js?key=<%= ENV['Map_API_KEY'] %>&callback=initMap"></script>

/users.js

function initMap() {
  // 地図を表示する要素を取得
  const mapElement = document.getElementById("map");
  // 地図の初期化
  const map = new google.maps.Map(mapElement, {
    center: { lat: 34., lng: 138. }, // 中心
    zoom: 13, // ズームレベル
  });

}

/env

# Google map用
Map_API_KEY = "私のAPI_KEY"

.gitignore
/.env # 追記

Geocoder.configure(
 # Geocoding options
 # timeout: 3,                 # geocoding service timeout (secs)
 lookup: :google, 👈 これ        # name of geocoding service (symbol) 
 # ip_lookup: :ipinfo_io,      # name of IP address geocoding service (symbol)
 # language: :en,              # ISO-639 language code
 use_https: true,  👈 これ         # use HTTPS for lookup requests? (if supported)
 # http_proxy: nil,            # HTTP proxy server (user:pass@host:port)
 # https_proxy: nil,           # HTTPS proxy server (user:pass@host:port)
 api_key: ENV['MAP_API_KEY'],   👈 これ            # API key for geocoding service
 # cache: nil,                 # cache object (must respond to #[], #[]=, and #del)
 # cache_prefix: 'geocoder:',  # prefix (string) to use for all cache keys
 # Exceptions that should not be rescued by default
 # (if you want to implement custom error handling);
 # supports SocketError and Timeout::Error
 # always_raise: [],
 # Calculation options
 # units: :mi,                 # :km for kilometers or :mi for miles
 # distances: :linear          # :spherical or :linear
)