Branch Deploy Preview Environment Variable Exposure

Question

Branch Deploy Preview Environment Variable Exposure
Netlify branch deploys generate public preview URLs for each commit, and environment variables assigned to a branch deploy may be available to the preview build runtime. The goal is to keep sensitive credentials out of preview contexts while preserving non-secret variables required for builds.
It is unclear whether netlify.toml can scope variables to production deploys only, or whether branch deploy previews inherit all account-level variables by default. Free tier users may also have limited UI controls for restricting variable visibility.
Can environment variables be restricted to production contexts so branch deploy previews do not receive them? Do preview builds respect the same variable filtering rules as production deploys? How can a team confirm that a specific variable is absent from a branch deploy preview runtime without exposing its value?

Muntasir · Answer

Short‑answer
Yes – Netlify lets you scope variables to the Production context only. Branch deploy previews will not receive those variables. The same scoping rules apply to all preview builds (deploy‑preview, branch‑deploy). You can verify a variable’s absence by checking the build log for its name (not its value) or by using the Netlify CLI to list context‑specific variables.

How Netlify Scopes Variables

Site‑level or account‑level variables that are not explicitly scoped are available to every deploy type.
  Variables can be assigned one or more scopes: Production, Deploy preview, Branch deploy, or All (default).
  Scoping is managed in the Netlify UI under Site Settings → Build & Deploy → Environment or via the netlify env:set CLI command. The netlify.toml file does not support variable scoping.

Ensuring Sensitive Variables Stay Out of Previews

Navigate to Site Settings → Build & Deploy → Environment in the Netlify dashboard.
  Locate the sensitive key (e.g., API_SECRET). Edit its scopes and uncheck Deploy preview and Branch deploy so it is only selected for Production.
  Save the changes. Netlify will apply the new scopes on the next deploy.
  If you prefer the CLI, run:
netlify env:set API_SECRET "s3cr3t" --scope production

Do Preview Builds Respect the Same Rules?
Yes. Netlify’s preview build pipeline reads the same environment‑variable configuration. Anything scoped to Production alone is invisible to both Deploy preview and Branch deploy runtimes.

Verifying Absence Without Exposing the Value

In a branch deploy, add a minimal log statement that prints the variable name if it exists:
console.log(process.env.API_SECRET !== undefined ? "API_SECRET present" : "API_SECRET absent");

Deploy the branch. In the build log, look for the string API_SECRET present. If it is not present, the variable was not injected.
  Alternatively, use the CLI to list variables for a specific context:
netlify env:list --site  --context branch

Confirm that API_SECRET does not appear in the output.

Things to Keep in Mind

Build‑time variables (used during the build step) are separate from runtime variables (available in the browser). For frameworks like Next.js, only variables prefixed with PUBLIC_ are exposed to the client.
  Changing variable scopes requires a new deploy to take effect.
  Free tier users can still set scopes via the UI; CLI access is optional but handy for scripting.

Diagnostic Question
Do you have Netlify CLI access, or will you rely solely on the web UI to adjust scopes?

Branch Deploy Preview Environment Variable Exposure