Description

Ensure no environment variable in the project applies to Production, Preview, and Development at the same time with a single value. Each environment should have its own variable and value, so that settings and secrets used in production are kept separate from testing and local development.

Rationale

When one variable targets all three environments, the same value, often a production secret, is used by preview deployments built from any branch and is downloaded to developer machines with vercel env pull. A leak from a preview or a laptop then exposes production systems. Separate values per environment limit the impact of any leak.

Impact

  • Keeps production values out of previews and local machines

  • Limits the impact of a preview or laptop compromise

  • Requires separate values for each environment

Default Value

By default, Vercel lets you select all three environments when adding a variable, and it does not prevent the same value from being shared.

Pre-Requisites

  • Team Owner or Member role, or Project Administrator

  • Separate values or credentials for each environment

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. Review the variables listed for Production, then open Preview and Development and compare.

  6. Flag any variable that applies to Production, Preview, and Development together.

  7. If any are found, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. Edit the flagged variable so it targets Production only, and save.

  6. Add a new variable with the same name and a separate value for Preview and Development.

  7. Redeploy the project.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. Remove the new Preview and Development variable.

  6. Edit the original variable to target all three environments again, and redeploy.

Reference