Via the incident page:

> Environment variables marked as "sensitive" in Vercel are stored in a manner that prevents them from being read, and we currently do not have evidence that those values were accessed. However, if any of your environment variables contain secrets (API keys, tokens, database credentials, signing keys) that were not marked as sensitive, those values should be treated as potentially exposed and rotated as a priority.

https://vercel.com/kb/bulletin/vercel-april-2026-security-in... as of 4:22p ET

▲

aziaziazi 3 hours ago | parent | next [-]

The “sensitive” toggle is off by default. I’m curious about the rationale, what's the benefit of this default for users and/or Vercel?

https://vercel.com/docs/environment-variables/sensitive-envi...

▲

loloquwowndueo 2 hours ago | parent | next [-]

Sensitive environment variables are environment variables whose values are non-readable once created.

So they are harder to introspect and review once set.

It’s probably good practice to put non-secret-material in non-sensitive variables.

(Pure speculation, I’ve never used Vercel)

	▲	_heimdall 2 hours ago \| parent [-]
		I have used Vercel though prefer other hosts. There are cases where I want env variables to be considered non-secure and fine to be read later, I have one in a current project that defines the email address used as the From address for automated emails for example. In my opinion the lack of security should be opt-in rather than opt-out though. Meaning it should be considered secure by default with an option to make it readable.

▲

throw03172019 an hour ago | parent | prev [-]

Simpler for vibe coders.

▲

jtchang an hour ago | parent | prev [-]

How does the app read the variable if it can't be read after you input it? Or do they mean you can't view it after providing the variable value to the UI?