Environment variables and secrets

Separate preview and production values, rotate credentials and prevent client exposure.

Implementation order

Assign an owner.
Separate preview and production.
Configure the smallest safe baseline.
Test expected and failure paths.
Document evidence and rollback.

Evidence standard

A builder-generated screen or successful demo is not proof. Verify the deployed configuration, a real non-admin user flow, alerts and recovery behavior.

Run readiness check →