Back to Checks
vercel

Vercel project has no environment variables targeting all three environments

project_environment_no_overly_broad_target
Service: projectSeverity: medium
OfficialBuilt-inVerified
Categories:secretsvercel-hobby-plan
Resource Type:NotDefined

Vercel project environment variables are assessed for overly broad targeting by checking whether any variable targets all three environments (production, preview, development) simultaneously, which violates the principle of least privilege.

Prowler logoProwlerprowler-provider-vercel

Risk

Environment variables targeting all environments share the same values across production, preview, and development, increasing blast radius if credentials are compromised. Production secrets are exposed to weaker environments, making it harder to isolate and track unauthorized changes.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks project_environment_no_overly_broad_target

Recommendation

Follow the principle of least privilege for environment variable targeting.

  • Assign each variable to only the environments where it is actually needed
  • Use different credentials for production, preview, and development environments
  • Non-sensitive configuration (e.g. feature flags, public URLs) may be acceptable in multiple environments but should still be reviewed
  • Regularly audit environment variable targets to prevent scope creep

Remediation

Other

1Navigate to your Vercel project dashboard
2Go to Settings > Environment Variables
3Identify variables that target all three environments (Production, Preview, Development)
4Edit each variable to target only the specific environments where it is needed
5Create separate variables with environment-specific values where different credentials are needed per environment

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.services.project.project_client import project_client

ALL_ENVIRONMENTS = {"production", "preview", "development"}


class project_environment_no_overly_broad_target(Check):
    """Check that no environment variables target all three environments simultaneously.

    This class verifies that environment variables are not configured to target
    production, preview, and development environments at the same time, which
    violates the principle of least privilege and may expose production secrets
    to development and preview contexts.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the no-overly-broad-target check.

        Iterates over all projects and inspects each environment variable,
        flagging any that target all three environments (production, preview,
        and development) simultaneously.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for project in project_client.projects.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=project)

            broad_keys = []
            for env_var in project.environment_variables:
                targets = {t.lower() for t in env_var.target}
                if ALL_ENVIRONMENTS.issubset(targets):
                    broad_keys.append(env_var.key)

            if broad_keys:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.name} has {len(broad_keys)} environment "
                    f"variable(s) targeting all three environments: "
                    f"{', '.join(broad_keys)}."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Project {project.name} has no environment variables targeting "
                    f"all three environments simultaneously."
                )

            findings.append(report)

        return findings

References