# Ensure Vercel project has no environment variables targeting all three environments

- Source: https://support.icompaas.com/support/solutions/articles/a_1790261998081839-ensure-vercel-project-has-no-environment-variables-targeting-all-three-environments
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure no environment variable in the project applies to Production, Preview, and Development at the same time with a single value. Each environment should have its own variable and value, so that settings and secrets used in production are kept separate from testing and local development.

**Rationale**

When one variable targets all three environments, the same value, often a production secret, is used by preview deployments built from any branch and is downloaded to developer machines with vercel env pull. A leak from a preview or a laptop then exposes production systems. Separate values per environment limit the impact of any leak.

**Impact**

-   Keeps production values out of previews and local machines
    
-   Limits the impact of a preview or laptop compromise
    
-   Requires separate values for each environment
    

**Default Value**

By default, Vercel lets you select all three environments when adding a variable, and it does not prevent the same value from being shared.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    
-   Separate values or credentials for each environment
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  Review the variables listed for Production, then open Preview and Development and compare.
    
6.  Flag any variable that applies to Production, Preview, and Development together.
    
7.  If any are found, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  Edit the flagged variable so it targets Production only, and save.
    
6.  Add a new variable with the same name and a separate value for Preview and Development.
    
7.  Redeploy the project.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  Remove the new Preview and Development variable.
    
6.  Edit the original variable to target all three environments again, and redeploy.
    

**Reference**

-   [https://vercel.com/docs/environment-variables](https://vercel.com/docs/environment-variables)
    
-   [https://vercel.com/docs/environment-variables/manage-across-environments](https://vercel.com/docs/environment-variables/manage-across-environments)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.