Secrets
Store and use environment variables and credentials securely.
Secrets include API keys, database credentials, signing keys, and other values that must not be committed to source control.
On Easel, secrets are stored as environment variables in project settings.
Environment scopes
Use different secret values for:
- Preview
- Production
Preview deployments do not automatically receive Production secrets. You can also set Preview branch overrides for branch-specific values.
Encryption and access
Easel encrypts environment variable values at rest and restricts access through workspace membership and project settings controls.
Sensitive variables are write-only in the dashboard after creation: you can replace the value, but you cannot read it back or rename the key in a way that exposes the prior secret.
Snapshots
When a deployment is created, Easel snapshots the resolved variable values for that environment. The build and runtime use that snapshot.
Changing variables later does not alter an existing deployment. Create a new deployment to pick up updates.
Build access
Build commands may read environment variables required to compile the application. Dependency installation scripts and build-time code may therefore access build-scoped secrets.
Reduce risk by:
- Avoiding unnecessary secrets during builds
- Pinning dependencies
- Reviewing install scripts
- Separating build and runtime credentials
- Using least-privilege tokens
- Rotating exposed credentials
Runtime access
Functions receive the secrets available in the deployment’s snapshot for that environment.
Logs
Automatic redaction cannot catch every transformed or encoded value. Applications must not log:
- Authorization headers
- Session cookies
- Full connection strings
- Private keys
- Access tokens
- Passwords
- Signed webhook secrets
Forks and Preview secrets
Treat Preview configuration as untrusted-input space:
- Keep Production secrets out of Preview variables
- Prefer Preview branch overrides only where needed
- Enable deployment protection when previews must not be public
Rotation
Rotate a secret when:
- A team member with access leaves
- It appears in source control or logs
- A third-party integration is compromised
- A credential reaches its scheduled rotation date
- Access scope changes
After updating a secret, create a new deployment so application code receives the new value.
Deletion
Deleting a secret prevents future deployments from receiving it. Existing deployments retain their previously resolved snapshot until they are replaced.