Description

Ensure Sensitive environment variables that hold production secrets target only the Production environment and not Preview. Preview deployments should use their own separate, lower-privilege credentials, stored in their own Sensitive variables.

Rationale

Preview deployments can be built from any branch, including code that has not been reviewed. If a production secret is also available to Preview, a malicious or careless branch can read and misuse it. Even though Sensitive values cannot be viewed in the dashboard, the running code can still access them, so production secrets must be limited to production.

Impact

  • Unreviewed branch code cannot access production secrets

  • Limits the impact of a compromised preview

  • Requires separate credentials for Preview

Default Value

By default, a Sensitive variable can target both Production and Preview with the same value.

Pre-Requisites

  • Team Owner or Member role, or Project Administrator

  • Separate credentials for Preview

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. Review each Sensitive variable and the environments it targets.

  6. Flag any Sensitive production secret that also targets Preview.

  7. If any are found, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. Edit the flagged variable so it targets Production only, and save.

  6. Add a new Sensitive variable with the same name and a separate Preview value, targeting Preview only.

  7. Redeploy the project.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.

  5. Remove the Preview variable and edit the original to target Production and Preview again.

  6. Redeploy the project.

Reference