Vercel project does not auto-expose system env vars

​

What this check verifies

Vercel projects are assessed for automatic system environment variable exposure (VERCEL_URL, VERCEL_ENV, VERCEL_GIT_COMMIT_SHA). When enabled, these variables are injected into every deployment and may be accessible in client-side JavaScript bundles if not handled carefully, leaking internal infrastructure details.

​

Risk

Automatically exposed system environment variables can reveal deployment URLs, Git metadata, environment names, and other internal details. If these values are inadvertently included in client-side bundles, attackers can use them to map infrastructure, identify staging environments, or craft targeted attacks against specific deployment instances.

​

Recommendation

Disable automatic exposure of system environment variables and explicitly define only the variables required by your application. This follows the principle of least privilege and reduces the risk of leaking internal infrastructure details through client-side code.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to the project Settings > Environment Variables
3. Locate the ‘Automatically expose System Environment Variables’ toggle
4. Disable the toggle
5. Manually add only the specific system variables your application needs

​

References

• https://vercel.com/docs/projects/environment-variables/system-environment-variables

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = project_auto_expose_system_env_disabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks