# Ensure Vercel sensitive production environment variables do not target preview

- Source: https://support.icompaas.com/support/solutions/articles/a_1790261999467880-ensure-vercel-sensitive-production-environment-variables-do-not-target-preview
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Sensitive environment variables that hold production secrets target only the Production environment and not Preview. Preview deployments should use their own separate, lower-privilege credentials, stored in their own Sensitive variables.

**Rationale**

Preview deployments can be built from any branch, including code that has not been reviewed. If a production secret is also available to Preview, a malicious or careless branch can read and misuse it. Even though Sensitive values cannot be viewed in the dashboard, the running code can still access them, so production secrets must be limited to production.

**Impact**

-   Unreviewed branch code cannot access production secrets
    
-   Limits the impact of a compromised preview
    
-   Requires separate credentials for Preview
    

**Default Value**

By default, a Sensitive variable can target both Production and Preview with the same value.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    
-   Separate credentials for Preview
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  Review each Sensitive variable and the environments it targets.
    
6.  Flag any Sensitive production secret that also targets Preview.
    
7.  If any are found, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  Edit the flagged variable so it targets Production only, and save.
    
6.  Add a new Sensitive variable with the same name and a separate Preview value, targeting Preview only.
    
7.  Redeploy the project.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open the environment (Production, Preview, or Development). Scroll to the Environment Variables section.
    
5.  Remove the Preview variable and edit the original to target Production and Preview again.
    
6.  Redeploy the project.
    

**Reference**

-   [https://vercel.com/docs/environment-variables/sensitive-environment-variables](https://vercel.com/docs/environment-variables/sensitive-environment-variables)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.