Sensitive Environment Variables appear encrypted in server functions when accompanied by a comment

[sandengocka]

Page to Investigate

Vercel > Project Settings > Environment Variables

Description

When creating a sensitive environment variable without a comment, the name and value are readable within a server function (Node.js). However, after adding a comment to the sensitive environment variable and redeploying the app, the API key becomes unreadable, as if it were encrypted, and not being properly decrypted for use in the server function.

Steps to Reproduce

1. Add a sensitive environment variable in Vercel's project settings without a comment (with Production and Preview checked)
2. Deploy the app and verify that the environment variable is readable in a server function.
3. Add a comment to the sensitive environment variable in Vercel's project settings.
4. Redeploy the app.
5. Observe that the environment variable appears encrypted and is not decrypted properly in the sever function, preventing it from being used.

Workaround

The temporary workaround is to remove the sensitive environment variables with comments, re-add them without comments, and redeploy the app.

Please let me know if you need any more info 😄

[amyegan]

Thanks for reporting this! The engineering team identified the cause and deployed a fix. 🙇