Vercel replaces Sensitive toggle with Config and Secret environment variable types

What changed

Vercel has replaced the Sensitive toggle on environment variables with two explicit types: Config and Secret. According to a changelog post on the Vercel blog, the choice now appears whenever you add or edit an environment variable, and the dashboard's variable list displays each entry's type alongside the environments where it applies.

The switch is backward compatible. Vercel says variables previously marked Sensitive are automatically treated as Secrets and continue to work without any migration step.

Config versus Secret

Config is meant for values that are not sensitive but that team members may need to inspect later. The value stays readable after saving for anyone with access to the project. Vercel points to settings such as variables carrying a public framework prefix as typical Config candidates.

Secret is aimed at credentials, including passwords, API keys and tokens. The value remains available to deployments and can be replaced, but once it is saved, members cannot view or retrieve it. This preserves the behaviour the old Sensitive toggle provided.

When adding a value, you can still scope it to a specific environment or to a Preview branch.

Team policy updates

The update deprecates the Enforce Sensitive Environment Variables team policy. When enabled, that policy required every environment variable a team member created to be Sensitive, even plainly non-sensitive configuration. With distinct Config and Secret types, members now pick the fitting type for each variable themselves.

A new Separate Production Secret Values policy is available in team Security settings. When switched on, the Production value of a Secret must differ from the values used for the same key in Preview, Development and custom environments. Vercel advises teams that had the legacy policy enabled to review whether the new policy should be turned on for them. The changelog also notes that the deprecated policy is no longer enforced by the Vercel CLI.

CLI support

The Vercel CLI supports the new types through a --visibility flag on vercel env add and vercel env update, which accepts either config or secret.

The older flags keep working: --no-sensitive maps to Config and --sensitive maps to Secret. After you add or update a variable, the CLI output reports its type under a Visibility field.

Why it matters

The change turns a boolean modifier into a first-class type system for environment variables, making the read and write semantics of each value explicit rather than an afterthought toggled at creation time. That clarity brings practical relief for teams that used the old enforcement policy, which forced even trivial configuration into write-only storage and made everyday debugging harder.

The new production-separation policy pushes credential hygiene further by requiring distinct production secrets once enabled. Teams that relied on the legacy policy should check their Security settings promptly, since the deprecated rule is no longer enforced by the CLI, leaving a potential gap unless the replacement policy is adopted. Scripts that pass --sensitive or --no-sensitive will keep working, so automation does not break in the short term.