# Ensure Vercel project has no secret-like environment variables stored as plain text

- Source: https://support.icompaas.com/support/solutions/articles/a_1790261999006842-ensure-vercel-project-has-no-secret-like-environment-variables-stored-as-plain-text
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure environment variables that hold secrets, such as API keys, tokens, passwords, private keys, and database connection strings, are stored as Sensitive environment variables. Sensitive values cannot be viewed or copied from the dashboard or API after they are created.

**Rationale**

Non-sensitive environment variables can be read by any team member with access to the project settings, and through the API. If secrets are stored this way, they can be viewed, copied, or leaked by anyone with access, including compromised accounts. Marking secrets as Sensitive makes their values unreadable after creation, reducing the risk of exposure.

**Impact**

-   Secret values cannot be read back after creation
    
-   Reduces the risk of secrets being copied or leaked
    
-   Sensitive variables can only target Production and Preview
    

**Default Value**

By default, environment variables are not Sensitive, and their values can be viewed in the dashboard. Teams can enforce Sensitive variables in team settings.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    
-   An inventory of secret variables
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  Review each variable whose name or purpose suggests a secret (for example, KEY, TOKEN, SECRET, PASSWORD, or DATABASE\_URL).
    
6.  Verify that each of these variables shows the Sensitive tag.
    
7.  If any secret is not Sensitive, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  Remove the flagged variable.
    
6.  Select Add Environment Variable, enter the same name and value, and set Sensitive to Enabled.
    
7.  Redeploy the project.
    
8.  Optionally, as an Owner, enable Enforce Sensitive Environment Variables in team Settings > Security & Privacy.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  Remove the Sensitive variable and add it again as a normal variable.
    
6.  Redeploy the project.
    

**Reference**

-   [https://vercel.com/docs/environment-variables/sensitive-environment-variables](https://vercel.com/docs/environment-variables/sensitive-environment-variables)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.