Sensitive Env Vars Should Be Default, Not Opt-In

I wrote a post earlier today about cleaning up after the Vercel breach. The cleanup itself is easy — ten minutes, a sequence of clicks, done. What's been bugging me all afternoon is a different question: Why is "sensitive" opt-in? The implicit default is wrong When you add an env var to Vercel, it's not marked sensitive by default. You have to remember to toggle it. This is the wrong default for a class of values where 99% of the time, "sensitive" is what you want. Think about the actual populat