Vercel
Security & compliance
Releases
Production/live secret found in preview env scope config
Part of the Preview deploy safety check · fix arrives as a guide
What it is
A production or live-mode secret is present in the preview environment scope.
Why it matters
Every preview build then holds it, including builds from branches that have not been reviewed. A live payment key in a preview environment can move real money from a test deployment.
How to fix it
Scope production secrets to the production environment only, and give preview its own test-mode credentials. Rotate any live key that has been available to preview builds.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.