Back to Checks
vercel

Vercel sensitive production environment variables do not target preview

project_environment_production_vars_not_in_preview
Service: projectSeverity: medium
OfficialBuilt-inVerified
Categories:secretsvercel-hobby-plan
Resource Type:NotDefined

Vercel project environment variables are assessed for environment separation by checking whether sensitive variables (type secret or encrypted) that target the production environment also target preview, which could expose production credentials to untrusted preview builds.

Prowler logoProwlerprowler-provider-vercel

Risk

Preview deployments are often triggered by pull requests, including those from external contributors or forks. Sharing production secrets with preview environments can lead to credential theft. Production API keys and database credentials could be exfiltrated by malicious code in preview builds and used to modify or disrupt live services.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks project_environment_production_vars_not_in_preview

Recommendation

Maintain strict environment separation between production and preview deployments.

  • Use dedicated, limited-scope credentials for preview environments
  • Never share production database credentials, API keys, or signing keys with preview builds
  • Enable Vercel's deployment protection features to further restrict access to preview deployments
  • Regularly audit which environment variables target multiple environments

Remediation

Other

1Navigate to your Vercel project dashboard
2Go to Settings > Environment Variables
3Identify sensitive variables (type Secret or Encrypted) that target both Production and Preview
4Edit each variable to remove the Preview target
5If preview builds require credentials, create separate variables with limited-scope preview-only credentials

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.services.project.project_client import project_client

SENSITIVE_TYPES = {"secret", "encrypted"}


class project_environment_production_vars_not_in_preview(Check):
    """Check that sensitive production environment variables do not also target preview.

    This class verifies that environment variables using "secret" or "encrypted"
    types that target "production" do not simultaneously target "preview"
    deployments, which could expose production credentials to untrusted code
    running in preview builds from pull requests.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the production-vars-not-in-preview check.

        Iterates over all projects, inspects each environment variable with a
        sensitive type (secret or encrypted), and flags any that target both
        "production" and "preview" environments.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for project in project_client.projects.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=project)

            leaking_keys = []
            for env_var in project.environment_variables:
                if env_var.type in SENSITIVE_TYPES:
                    targets = {t.lower() for t in env_var.target}
                    if "production" in targets and "preview" in targets:
                        leaking_keys.append(env_var.key)

            if leaking_keys:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.name} has {len(leaking_keys)} sensitive "
                    f"production environment variable(s) also targeting preview: "
                    f"{', '.join(leaking_keys)}."
                )
            else:
                report.status = "PASS"
                report.status_extended = (
                    f"Project {project.name} has no sensitive production environment "
                    f"variables leaking to preview deployments."
                )

            findings.append(report)

        return findings

References