Back to Checks
vercel

Vercel project has automatic exposure of system environment variables disabled

project_auto_expose_system_env_disabled
Service: projectSeverity: medium
OfficialBuilt-inVerified
Categories:trust-boundariesvercel-hobby-plan
Resource Type:NotDefined

Vercel projects are assessed for automatic system environment variable exposure (VERCEL_URL, VERCEL_ENV, VERCEL_GIT_COMMIT_SHA). When enabled, these variables are injected into every deployment and may be accessible in client-side JavaScript bundles if not handled carefully, leaking internal infrastructure details.

Prowler logoProwlerprowler-provider-vercel

Risk

Automatically exposed system environment variables can reveal deployment URLs, Git metadata, environment names, and other internal details. If these values are inadvertently included in client-side bundles, attackers can use them to map infrastructure, identify staging environments, or craft targeted attacks against specific deployment instances.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks project_auto_expose_system_env_disabled

Recommendation

Disable automatic exposure of system environment variables and explicitly define only the variables required by your application. This follows the principle of least privilege and reduces the risk of leaking internal infrastructure details through client-side code.

Remediation

Other

1Sign in to the Vercel dashboard
2Navigate to the project Settings > Environment Variables
3Locate the 'Automatically expose System Environment Variables' toggle
4Disable the toggle
5Manually add only the specific system variables your application needs

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.services.project.project_client import project_client


class project_auto_expose_system_env_disabled(Check):
    """Check if automatic exposure of system environment variables is disabled.

    This class verifies whether each Vercel project has the automatic exposure
    of system environment variables disabled to prevent information leakage.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel Project Auto Expose System Env check.

        Iterates over all projects and checks if automatic exposure of system
        environment variables is disabled.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for project in project_client.projects.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=project)

            if not project.auto_expose_system_envs:
                report.status = "PASS"
                report.status_extended = (
                    f"Project {project.name} does not automatically expose "
                    f"system environment variables to the build process."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.name} automatically exposes system "
                    f"environment variables to the build process."
                )

            findings.append(report)

        return findings

References