Branch Deploy Preview Environment Variable Exposure

Branch Deploy Preview Environment Variable Exposure

Netlify branch deploys generate public preview URLs for each commit, and environment variables assigned to a branch deploy may be available to the preview build runtime. The goal is to keep sensitive credentials out of preview contexts while preserving non-secret variables required for builds.

It is unclear whether netlify.toml can scope variables to production deploys only, or whether branch deploy previews inherit all account-level variables by default. Free tier users may also have limited UI controls for restricting variable visibility.

Can environment variables be restricted to production contexts so branch deploy previews do not receive them? Do preview builds respect the same variable filtering rules as production deploys? How can a team confirm that a specific variable is absent from a branch deploy preview runtime without exposing its value?