env-vars

To sync Vercel environment variables locally, use the `vercel env pull` command to generate a `.env.local` file, ensuring your local development environment matches your deployment secrets without manual copying.

Scoping secrets across Vercel deployment environments involves using environment-specific variable assignments and the `vercel env` CLI to manage access controls, ensuring sensitive data remains isolated to specific deployment targets like production or preview.

OIDC token management for Vercel deployments handles authentication workflows for AI gateways and cloud services by defining token lifecycles and access scoping, replacing long-lived static secrets with dynamically rotated credentials.

Use the `NEXT_PUBLIC_` prefix for environment variables when you need to expose specific values to the browser client, while keeping non-prefixed variables secure and server-side only to prevent accidental secrets exposure.

Safety checks for prompt injection and data exfiltration validate frontmatter metadata and restrict retrieval fields, preventing malicious inputs from accessing or exporting sensitive secrets during environment variable workflows.

Yes, you can use `vercel env add` to inject new secrets and `vercel env rm` to delete existing project variables across local and deployment environments, ensuring precise lifecycle management.