# Ensure Vercel project has automatic exposure of system environment variables disabled

- Source: https://support.icompaas.com/support/solutions/articles/a_1790261998502678-ensure-vercel-project-has-automatic-exposure-of-system-environment-variables-disabled
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the Enable access to System Environment Variables setting (previously called Automatically expose System Environment Variables) is disabled unless the project needs it, so that Vercel does not automatically add system values such as deployment URLs, Git branch names, commit messages, and commit authors to every build and runtime environment.

**Rationale**

System environment variables reveal details about the project, its Git repository, branches, commits, and deployment URLs. If they are exposed automatically, application code or frontend bundles may leak this information to users. Disabling automatic exposure reduces information disclosure. Note that Skew Protection needs this setting, so both requirements must be weighed together.

**Impact**

-   Reduces exposure of Git and deployment details
    
-   Skew Protection stops working when this is disabled
    
-   Code that uses system variables such as VERCEL\_URL may break
    

**Default Value**

By default, Enable access to System Environment Variables is checked.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    
-   A review of code that uses VERCEL\_ system variables
    
-   A decision on whether Skew Protection is required
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  At the bottom of the Environment Variables section, check whether Enable access to System Environment Variables is checked.
    
6.  If it is checked and the project does not need it, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  At the bottom of the Environment Variables section, clear the Enable access to System Environment Variables checkbox.
    
6.  If the code needs a specific system value, add it manually as a normal environment variable.
    
7.  Redeploy the project and confirm it works.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  At the bottom of the Environment Variables section, check Enable access to System Environment Variables.
    
6.  Redeploy the project.
    

**Reference**

-   [https://vercel.com/docs/environment-variables/system-environment-variables](https://vercel.com/docs/environment-variables/system-environment-variables)
    
-   [https://vercel.com/docs/skew-protection](https://vercel.com/docs/skew-protection)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.