Vercel env vars do not target all three environments

​

What this check verifies

Vercel project environment variables are assessed for overly broad targeting by checking whether any variable targets all three environments (production, preview, development) simultaneously, which violates the principle of least privilege.

​

Risk

Environment variables targeting all environments share the same values across production, preview, and development, increasing blast radius if credentials are compromised. Production secrets are exposed to weaker environments, making it harder to isolate and track unauthorized changes.

​

Recommendation

Follow the principle of least privilege for environment variable targeting.

• Assign each variable to only the environments where it is actually needed
• Use different credentials for production, preview, and development environments
• Non-sensitive configuration (e.g. feature flags, public URLs) may be acceptable in multiple environments but should still be reviewed
• Regularly audit environment variable targets to prevent scope creep

​

Remediation

Dashboard steps

1. Navigate to your Vercel project dashboard
2. Go to Settings > Environment Variables
3. Identify variables that target all three environments (Production, Preview, Development)
4. Edit each variable to target only the specific environments where it is needed
5. Create separate variables with environment-specific values where different credentials are needed per environment

​

References

• https://vercel.com/docs/environment-variables

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = project_environment_no_overly_broad_target. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks