VERCEL ERRORS

Hardcoded API key in a repository deployed to Vercel

A key written into source code ships with the repository. Move it to an environment variable, store it as a Secret, rotate it and keep it out of NEXT_PUBLIC_.

What it means

Vercel environment variables are key-value pairs configured outside your source code. A key written directly into a file is part of the repository and of any build that includes it. Vercel offers two types: Config values stay readable to members with project access, while Secret values are write-only after saving. Vercel recommends Secrets for passwords, API keys and tokens.

GitHub's guidance on sensitive data is that a leaked credential should first be revoked or rotated, and that rewriting history may not be warranted once it is.

How to fix it

  1. Replace the value in code with a read from process.env.
  2. Add the variable in the Vercel project as a Secret, for the environments that need it.
  3. Rotate the key at the provider. Vercel documents steps for rotating environment variables without downtime. Treat the old value as exposed.
  4. Do not put a secret behind a NEXT_PUBLIC_ name. Next.js inlines NEXT_PUBLIC_ values into the JavaScript sent to the browser at build time.
  5. Keep .env files out of Git. The default Next.js template adds all .env files to .gitignore, and the documentation says you almost never want to commit them.
  6. Redeploy. Changed variables only apply to new deployments.
// Before
const stripe = new Stripe("<secret key pasted here>");

// After
const key = process.env.STRIPE_SECRET_KEY;
if (!key) throw new Error("STRIPE_SECRET_KEY is not set");
const stripe = new Stripe(key);

What a DeployDoctor scan can check

The hardcoded secrets check looks for live Stripe, AWS, GitHub and Supabase keys and private keys in source. Reports show only the prefix and the last four characters. The environment variable check also reports secret-looking values exposed through NEXT_PUBLIC_. It does not cover every kind of secret, and it does not rotate a key for you.

Sources

Documentation last checked 2026-10-28. Vercel can change its documentation; confirm against the linked pages.