Vercel
Security & compliance
Code quality
Production secret env var older than a year (rotation hygiene)
Part of the Public env exposure check · fix arrives as a guide
What it is
A production secret environment variable has not been changed in over a year.
Why it matters
Rotation bounds the useful life of a credential that leaked without anyone noticing — through a log, a screenshot, or a former team member's access. A key that has never rotated has an unbounded window.
How to fix it
Rotate it, and set a schedule. Where the provider supports overlapping keys, add the new one before removing the old so rotation does not need a maintenance window.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.