Vercel
Security & compliance
Releases
Code quality
System env vars auto-exposed to every build (autoExposeSystemEnvs)
Part of the Public env exposure check · fix arrives as a guide
What it is
autoExposeSystemEnvs is enabled, so Vercel system environment variables are injected into every build.
Why it matters
The variables land in every build environment, including builds triggered from forked pull requests, where the commit SHA, branch, deployment URL and git author are readable by whoever opened the PR. They do not reach the browser unless a framework-prefixed variant is referenced in client code — but the surface is wider than it needs to be.
How to fix it
Disable automatic exposure and add the specific system variables you use, individually, where they are needed.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.