Quick answer
Learn where build settings belong, how environments differ and how to check that secrets never reach browsers. Environment variables help configure deployments, but their location and exposure matter. A secret placed in a client bundle is no longer secret, even if it originated as an environment variable.
Environment variables help configure deployments, but their location and exposure matter. A secret placed in a client bundle is no longer secret, even if it originated as an environment variable.
Before you begin
Use a sample Vercel project and a nonsecret example value for practice. Keep real credentials out of screenshots, terminal recordings and commit history.
Method guide · not a product benchmark01Separate server and browser values
Classify each configuration item before adding it. A public site URL can be visible to users; API private keys and database passwords must stay on the server. Build-time substitution can permanently embed data in static assets.
02Choose the correct environment
Inspect Production, Preview and Development targets in your Vercel project. Use separate values and minimum access where practical. Never assume a Preview deployment is protected merely because it is not Production.
03Add a variable securely
Under Project Settings and Environment Variables, add the key and appropriate target. For this practice use a harmless value such as PUBLIC_SITE_NAME=Demo. Avoid copying secret values into code, issue comments or a public repository.
04Redeploy and verify behavior
Trigger a new deployment when needed for updated build settings. Verify the environment value is used as expected without printing secrets. Inspect generated JavaScript and HTML to ensure private values were not accidentally bundled.
05Rotate leaked secrets immediately
If a secret is committed, displayed in build logs or exposed in browser assets, revoke it at the provider and issue a new one. Removing it from the latest Git commit is not sufficient if older commits or logs retain the value.
Try this prompt
Review these variable NAMES only for accidental public exposure and environment targeting. Do not request or reproduce actual values: [names].
Worked example
Fictional teaching example — not a product test or a real customer record.
Starting information
Fictional learning example; no live customer data or measured product outputs.
Expected result
Expected: complete the steps, keep evidence, and verify the real interface before acting.
Before you use the result
- Confirm the exact software version and access rights.
- Keep secrets and private records out of demonstrations.
- Do not treat this hypothetical result as a real test.
Worksheet
Editable text file. Fill it with your own evidence; blank fields are not results.
Download the worksheet (.txt)
