Goal

Deploy a Next.js monorepo Preview while retaining a fail-closed policy that rejects all unapproved NEXT_PUBLIC_* variables.

Environment

• Vercel Hobby project: d4-optimizer-synthetic-preview (prj_GfjuMxchiPV28dCbCuUGBaEeKnBq)
• Vercel CLI 62.0.0; Next.js 16.3.5; Node 24.x; pnpm 11.19.0
• Monorepo install root: repository root. Vercel Root Directory: apps/web, with workspace sources outside it included.
• Install: pnpm install --frozen-lockfile. Build: pnpm --filter @d4/web build.

Expected behavior

Project-level automatic System Environment Variable exposure is disabled, and there are zero user-defined project variables. The repository has no direct or transitive @vercel/analytics or @vercel/speed-insights dependency, and application source imports neither package. The project API reports features.webAnalytics: false. A local Vercel Preview build succeeds with the guard unchanged. I expected the remote Preview build not to receive an unexpected NEXT_PUBLIC_VERCEL_* variable.

Actual behavior

Remote deployment dpl_GxgnRw6Lp6esbcXnH5ZUR1z4P6qn was correctly classified as Preview but reached ERROR during Next.js page-data collection for /_not-found. The existing application guard reported: "Client-exposed environment variable NEXT_PUBLIC_VERCEL_OBSERVABILITY_CLIENT_CONFIG is prohibited. Keep credentials server-only." The variable value is intentionally omitted. The application never became available. An earlier separate first deployment, dpl_4ePrphRtPK4CYb7h9rKMnitcBvG7, was Production/ERROR on a different system variable while automatic exposure was enabled; it was not a Preview deployment.

Investigation completed

Fresh project inspection still reports autoExposeSystemEnvs: false and zero project-defined variables. Relevant team-shared variables and integration resources were absent on read-only inspection. Web Analytics is explicitly false. Speed Insights metadata has an ID and hasData: false; that does not establish whether the feature is enabled. General Observability is distinct from client Analytics/Speed Insights. No matching package import, local production-output marker, or known client intake endpoint was found. Vercel documents the unprefixed VERCEL_OBSERVABILITY_CLIENT_CONFIG as shared client package configuration and separately documents framework-prefixed variables, but neither establishes this build's exact injection path. The inspected open-source prefix helper does not include Observability in its allowlist. The exact provider component remains unresolved.

Security impact

The application intentionally rejects unapproved NEXT_PUBLIC_* names because such values may enter client output; it does not use Vercel client observability. I would prefer a supported project-level opt-out or an explanation of the expected hosting contract. I do not want to weaken the guard without understanding the variable's source, stability, and client exposure. I am not asserting that the value is a secret.

Questions for Vercel

1. Which Vercel component injects NEXT_PUBLIC_VERCEL_OBSERVABILITY_CLIENT_CONFIG into this remote Preview build?
2. Is the variable controlled by Web Analytics, Speed Insights, general Observability, the Next.js build integration, or another build service?
3. Why is it injected while project-level System Environment Variable exposure is disabled and no user-defined variables exist?
4. Is there a documented project-level method to prevent this variable from being injected without disabling the application's strict NEXT_PUBLIC_* policy?
5. Is the variable expected to be included in the browser client bundle, and is its schema/name considered a stable public hosting contract?
6. If the behavior is unintended, is there an existing issue or rollout the project should follow?

References: Framework Environment Variables, System Environment Variables, Web Analytics package configuration, Speed Insights package configuration, and Vercel's prefix helper.