The “sensitive” toggle is off by default. I’m curious about the rationale, what's the benefit of this default for users and/or Vercel?
replyhttps://vercel.com/docs/environment-variables/sensitive-envi...
Sensitive environment variables are environment variables
whose values are non-readable once created.
replySo they are harder to introspect and review once set.
It’s probably good practice to put non-secret-material in non-sensitive variables.
(Pure speculation, I’ve never used Vercel)
I have used Vercel though prefer other hosts.
replyThere are cases where I want env variables to be considered non-secure and fine to be read later, I have one in a current project that defines the email address used as the From address for automated emails for example.
In my opinion the lack of security should be opt-in rather than opt-out though. Meaning it should be considered secure by default with an option to make it readable.
Simpler for vibe coders.
replyHow does the app read the variable if it can't be read after you input it? Or do they mean you can't view it after providing the variable value to the UI?
replyThey mean the latter. Very unclear how that translates to meaningful security.
reply