Vercel production env vars do not target preview

​

What this check verifies

Vercel project environment variables are assessed for environment separation by checking whether sensitive variables (type secret or encrypted) that target the production environment also target preview, which could expose production credentials to untrusted preview builds.

​

Risk

Preview deployments are often triggered by pull requests, including those from external contributors or forks. Sharing production secrets with preview environments can lead to credential theft. Production API keys and database credentials could be exfiltrated by malicious code in preview builds and used to modify or disrupt live services.

​

Recommendation

Maintain strict environment separation between production and preview deployments.

• Use dedicated, limited-scope credentials for preview environments
• Never share production database credentials, API keys, or signing keys with preview builds
• Enable Vercel’s deployment protection features to further restrict access to preview deployments
• Regularly audit which environment variables target multiple environments

​

Remediation

Dashboard steps

1. Navigate to your Vercel project dashboard
2. Go to Settings > Environment Variables
3. Identify sensitive variables (type Secret or Encrypted) that target both Production and Preview
4. Edit each variable to remove the Preview target
5. If preview builds require credentials, create separate variables with limited-scope preview-only credentials

​

References

• https://vercel.com/docs/environment-variables

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = project_environment_production_vars_not_in_preview. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks