# Ensure production secrets are scoped to production environments

- Source: https://support.icompaas.com/support/solutions/articles/a_1793876662859192-ensure-production-secrets-are-scoped-to-production-environments
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Render Cloud](https://support.icompaas.com/support/solutions/c_1793875953948152) › [Checks](https://support.icompaas.com/support/solutions/folders/f_1793875960840493)
- Last updated: 2026-11-05
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure environment groups that contain production secrets, such as API keys, passwords, and connection strings, are moved into the production project environment. A scoped environment group can only be linked to services in that environment, so non-production services cannot use production credentials.

**Rationale**

An environment group that is not scoped can be linked to any service in the workspace, including staging and test services. This makes it easy to accidentally connect a test service to production systems with production credentials. Scoping the group to the production environment prevents this.

**Impact**

-   Only production services can use production secrets
    
-   Prevents test services from using production credentials
    
-   Groups must be organized by environment
    

**Default Value**

By default, environment groups are not scoped to an environment and can be linked to any service in the workspace.

**Pre-Requisites**

-   Workspace Admin role (or Developer for non-protected environments)
    
-   Production resources organized into a project environment
    

**Remediation**

**Test Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Click Environment Groups in the left pane and review each group that holds production secrets.
    
3.  Check whether each group appears on the production project's overview page (meaning it is scoped to that environment).
    
4.  If a production group is not scoped, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Click Environment Groups in the left pane and open the environment group's info page.
    
3.  Click Manage > Move group and select the production project environment.
    
4.  Confirm the group now appears on the production project's overview page.
    
5.  Unlink the group from any non-production services and give them their own non-production group.
    

**Backout Plan**

1.  Sign in to the Render Dashboard at [https://dashboard.render.com](https://dashboard.render.com/).
    
2.  Click Environment Groups in the left pane, open the group, click Manage > Move group, and move it back out of the environment.
    

**Reference**

-   [https://render.com/docs/projects](https://render.com/docs/projects)
    
-   [https://render.com/docs/configure-environment-variables](https://render.com/docs/configure-environment-variables)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.