Description

Ensure environment variables that hold secrets, such as API keys, tokens, passwords, private keys, and database connection strings, are stored as Sensitive environment variables. Sensitive values cannot be viewed or copied from the dashboard or API after they are created.

Rationale

Non-sensitive environment variables can be read by any team member with access to the project settings, and through the API. If secrets are stored this way, they can be viewed, copied, or leaked by anyone with access, including compromised accounts. Marking secrets as Sensitive makes their values unreadable after creation, reducing the risk of exposure.

Impact

  • Secret values cannot be read back after creation

  • Reduces the risk of secrets being copied or leaked

  • Sensitive variables can only target Production and Preview

Default Value

By default, environment variables are not Sensitive, and their values can be viewed in the dashboard. Teams can enforce Sensitive variables in team settings.

Pre-Requisites

  • Team Owner or Member role, or Project Administrator

  • An inventory of secret variables

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. Review each variable whose name or purpose suggests a secret (for example, KEY, TOKEN, SECRET, PASSWORD, or DATABASE_URL).

  6. Verify that each of these variables shows the Sensitive tag.

  7. If any secret is not Sensitive, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. Remove the flagged variable.

  6. Select Add Environment Variable, enter the same name and value, and set Sensitive to Enabled.

  7. Redeploy the project.

  8. Optionally, as an Owner, enable Enforce Sensitive Environment Variables in team Settings > Security & Privacy.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. Remove the Sensitive variable and add it again as a normal variable.

  6. Redeploy the project.

Reference