Build logs now redact Sensitive Environment Variable values
By Steven Van ·
Vercel masks Sensitive values of 32 characters or more in build logs and logs each redaction's key, project, and deployment in the Activity Log.
Build logs on Vercel now mask Sensitive Environment Variable values that are 32 characters or longer, replacing them with [REDACTED] wherever they would otherwise show up in a deployment's build output. The Build Logs view flags when redaction has happened, so teams can see why part of the log was masked without the underlying value ever being exposed.
Two system environment variables, VERCEL_AUTOMATION_BYPASS_SECRET and VERCEL_OIDC_TOKEN, are always redacted regardless of length. Each time a value is masked, Vercel adds an Activity Log entry recording the variable's key, project, and deployment, but never the value itself.