Description

Ensure the Enable access to System Environment Variables setting (previously called Automatically expose System Environment Variables) is disabled unless the project needs it, so that Vercel does not automatically add system values such as deployment URLs, Git branch names, commit messages, and commit authors to every build and runtime environment.

Rationale

System environment variables reveal details about the project, its Git repository, branches, commits, and deployment URLs. If they are exposed automatically, application code or frontend bundles may leak this information to users. Disabling automatic exposure reduces information disclosure. Note that Skew Protection needs this setting, so both requirements must be weighed together.

Impact

  • Reduces exposure of Git and deployment details

  • Skew Protection stops working when this is disabled

  • Code that uses system variables such as VERCEL_URL may break

Default Value

By default, Enable access to System Environment Variables is checked.

Pre-Requisites

  • Team Owner or Member role, or Project Administrator

  • A review of code that uses VERCEL_ system variables

  • A decision on whether Skew Protection is required

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. At the bottom of the Environment Variables section, check whether Enable access to System Environment Variables is checked.

  6. If it is checked and the project does not need it, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. At the bottom of the Environment Variables section, clear the Enable access to System Environment Variables checkbox.

  6. If the code needs a specific system value, add it manually as a normal environment variable.

  7. Redeploy the project and confirm it works.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. At the bottom of the Environment Variables section, check Enable access to System Environment Variables.

  6. Redeploy the project.

Reference