Ok, now the “rotate secrets” button disappeared and there is a Vercel incident again…
I cannot edit the DB connection values in the environment variables manually. And you pull the wrong ones automatically. This is a pretty big fuck up to just roll out to your users. Please fix this. I mean it’s cool to automate shit. But why the hell can I not edit these variables?
when I click “Rotate Integration Secrets” for my Neon database, it does not pick up the main (default) branch connection strings, but the latest branch (dev). Since I cannot edit environment variables manually I am now stuck with a production deployment without a working database connection.
I just got hit by the same issue and came close to data loss!
This occurs when you have several DATABASE_URL values depending on the environment (production, and several previews AFAIC).
To me the culprit is the UI/UX of the secret rotation: it’s a menu entry on each line of the variables… So when you want to rotate DATABASE_URL and that you click on one row you expect that rotation will occur on that row… instead it sets the same value to all rows.
What I wanted to do is change the DATABASE_URL of my staging environment.
By doing so I just pointed the production environment to a staging branch on Neon The only thing that saved me is that I did not click on the “redeploy” toast showing up… otherwise all my users would have written to the staging DB… which is reset every night (hence the data loss).
Now the “edit” function works pretty well, while the “rotate” is very error prone and meaningless to me: when you bothered creating one value of secret per environment, in which world do you believe that upon rotation, you’re no longer be willing to keep those values different!??
Really this feature looks like it was designed by an agent… IMO it must be removed ASAP.
Best.
Admittedly there’s a small menu entry to specify different values for prod and preview but:
I doubt anybody sees it because the user is 100% sure he is only editing that line
It only allows prod and preview => not 1 preview per branch
I’d avoid using Rotate Integration Secrets for this setup until the scope is clear, because your example is the risky case: production can end up pointing at a staging/preview Neon branch, and that only becomes dangerous once a new production deployment picks up the changed variable.
For now I’d treat it as a manual verification step before redeploying production:
1. In Neon, copy the connection string for the exact branch/database you want production to use.
2. In Vercel → Project Settings → Environment Variables, check DATABASE_URL for Production only.
3. Check Preview separately, especially any branch-specific Preview values.
4. Redeploy only after confirming the Production value points to the production Neon branch.
If you need production, staging, and preview branches to stay different, I’d also consider using explicit names instead of one shared DATABASE_URL everywhere, for example:
Then your app can select the right one based on the environment, and a rotation action on one variable is less likely to silently affect another environment.
One useful sanity check before redeploying is to compare the Neon host/branch in the URL, not the password value. Don’t paste the full connection string publicly, but the hostname/branch name is enough to confirm whether Vercel is pointing at the expected Neon branch.
