Vercel Preview build does not receive Sensitive environment variables, but Config variables work

Hi Vercel team,

I have a Vite + React project deployed on Vercel. The application uses an existing Supabase project and the frontend only needs the Supabase public/publishable key.

The issue was:

Vercel Environment Variables showed both variables correctly assigned to Production + Preview.
The variables were created as Sensitive.
The Vite build completed successfully, but the deployed Preview received empty values for both variables.
This caused the application to fail before React mounted.

The application reads the variables normally:

const supabasePublicKey =
  import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY ||
  import.meta.env.VITE_SUPABASE_ANON_KEY;

and vite.config.ts also explicitly maps the Vercel environment into the Vite browser configuration:

'import.meta.env.VITE_SUPABASE_PUBLISHABLE_KEY': JSON.stringify(
  process.env.VITE_SUPABASE_PUBLISHABLE_KEY ||
  process.env.NEXT_PUBLIC_SUPABASE_PUBLISHABLE_KEY ||
  process.env.SUPABASE_PUBLISHABLE_KEY ||
  process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||
  process.env.SUPABASE_ANON_KEY ||
  ''
),

So there was no intentional filtering of the variable.

What we observed

We temporarily changed the Vercel Build Command to:

node -e "console.log('MARKL_SUPABASE_KEY_PRESENT=' + Boolean(process.env.VITE_SUPABASE_PUBLISHABLE_KEY)); console.log('(myapp)_SUPABASE_URL_PRESENT=' + Boolean(process.env.VITE_SUPABASE_URL))" && npm run build

The Preview build reported:

(myapp)_SUPABASE_KEY_PRESENT=false
(myapp)_SUPABASE_URL_PRESENT=false

The browser then failed with:

[SUPABASE AUTH CONFIG]
Uncaught Error: AUTH_CONFIG_MISSING_PUBLIC_KEY

The exception occurred before createRoot().render(), which explains the completely blank page.

The strange part

The Vercel CLI showed that the variables existed in Preview:

VITE_SUPABASE_URL                  Production, Preview
VITE_SUPABASE_PUBLISHABLE_KEY      Production, Preview

vercel pull --environment=preview also created both entries locally.

However, the actual Preview build still saw both values as missing.

Workaround

We deleted and recreated the two variables as normal Config variables instead of Sensitive, keeping the same values and the same Production + Preview scopes.

For the Supabase public/publishable key we marked it as safe to expose to the browser, since this is a public client-side Supabase key and not a service-role/secret key.

After a new Preview deployment, the application started correctly.

So the practical workaround was:

Sensitive
    ↓
Config
    ↓
Preview redeploy
    ↓
variables available to Vite build
    ↓
application works

Why I am reporting this

I would like to know whether this is expected behaviour or a Vercel bug/regression.

If Sensitive Environment Variables are expected to be available to the Preview build, the fact that:

process.env.VITE_SUPABASE_URL
process.env.VITE_SUPABASE_PUBLISHABLE_KEY

were both absent during the build is unexpected.

If Sensitive variables are intentionally unavailable at some stage of the Preview build pipeline, the documentation/UI should make that limitation much clearer, because the variables appeared correctly scoped to Preview in the dashboard.

The project is using:

Vite
React
Vercel Preview
Supabase
Node 24
Vercel CLI 59.26.0

No database provisioning was performed. We did not use Vercel's "Install Database" flow, and the existing Supabase project was not modified.

Could someone from the Vercel team confirm whether this is expected and, if not, investigate the Preview build environment injection for Sensitive variables?

Thanks.

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.