Using express-expose to share (or "disclose") data from server to client works very well. As Rainos said, I would save confidential variables as environment variables, and then you can safely expose all your settings.
Or you can do something like creating a βcommonβ object in your settings. Like this:
app.set('shared', { setting1: mydata , setting2: new OAuth(...) , setting3: { ... } });
Which allows you to access settings like app.setting.shared.setting1 on the server, and then you can app.expose(app.setting.shared) so that your client side JS can access the same object.
source share