{
  "slug": "vercel-env-add-defaults-production-and-preview-variables-to-sensitive-69148cd500e0",
  "title": "vercel env add defaults Production and Preview variables to sensitive",
  "tools": [
    "vercel"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-04-20T07:25:48.000Z",
  "announced_at": "2026-04-20T07:25:48.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When adding a variable to Production or Preview, run `vercel env add` and it defaults to sensitive; pass `--no-sensitive` to request the prior encrypted behavior. For Development, add it separately and omit `--sensitive`.",
    "examples": [
      "vercel env add <NAME> <production|preview>",
      "vercel env add <NAME> <development>",
      "vercel env add <NAME> <production|preview> --no-sensitive"
    ],
    "gotchas": [
      "Version: 51.8.0",
      "<NAME> (required): Environment variable name; positional argument.",
      "<production|preview|development> (required): Target environment; positional argument. Add Development separately from Production or Preview.",
      "--sensitive: Marks a variable sensitive; release note says it errors when Development is selected.",
      "--no-sensitive: New flag to request encrypted behavior for Production or Preview; on a team enforcing sensitive variables it is a no-op with a warning.",
      "Prerequisite: Run from a Vercel project context; the documentation describes adding variables to a Vercel Project.",
      "Prerequisite: Enter the variable value when prompted, or provide it through stdin using the documented command form.",
      "Sensitive values are encrypted at rest and cannot be retrieved later via the dashboard or CLI; they are still resolved for builds, deployments, `vercel env pull`, and runtime.",
      "Development is always stored as encrypted; sensitive is not supported by the Vercel API for Development.",
      "A mixed Development and Production/Preview selection errors; add Development separately.",
      "Passing `--sensitive` with Development errors up-front.",
      "Passing `--sensitive` and `--no-sensitive` together errors.",
      "On teams with the Enforce Sensitive Environment Variables policy enabled, `--no-sensitive` is a no-op for Production/Preview because the server promotes the variable regardless."
    ]
  },
  "why_it_matters": "Add an environment variable to a Vercel Production or Preview target, or to Development when that target is selected.",
  "before": "Production and Preview variables defaulted to encrypted and remained readable later; `--sensitive` could request sensitive storage. For Development, `--sensitive` silently fell back to encrypted, and a mixed target selection could not share a record type.",
  "sources": [
    "https://github.com/vercel/vercel/releases/tag/vercel%4051.8.0",
    "https://vercel.com/docs/cli/env"
  ],
  "rank": 0.96049,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v1+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "backfill-20261007",
    "verdict_id": "backfill-20261007:backfill-20261007-023f723fd1d0b4f6-0:gate",
    "evidence_hash": "b67d4adcc97b0b1d9bcc7e687524856ef6501910d158e18cc1cbdabddddc8e33"
  },
  "review": {
    "draft_hash": "e7b18b887ee84485b150873e32a3e4082c33f3c4bc165e5ded17bfa8c0fd41e8",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "backfill-20261007:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.96 >= 0.9; 2 needed) and Jev gave 0.79 (>= 0.6 needed)."
  }
}