Repository navigation
Conversation
Contributor
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
luismeyer
marked this pull request as ready for review
November 10, 2026 15:33
…S_SECRET Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…ut new options Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…secret Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
…rcel-platform Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
luismeyer
force-pushed
the
luismeyer/flag-values-platform-encryption
branch
from
November 10, 2026 15:33
f487791 to
888794b
Compare
chriswdmr
reviewed
Nov 10, 2026
chriswdmr
left a comment
chriswdmr
left a comment
Member
There was a problem hiding this comment.
Thanks! Three things to fix before merge:
- SvelteKit without a secret: a failure to load the key must not break the page render
- Add a timeout to the key set fetch
- Next.js middleware: remove the two new Edge Runtime build warnings
The other comments are suggestions and nits.
- Read env vars without a process global and from SvelteKit's $env - Memoize the OIDC decode and the .vercel/project.json read - No Edge Runtime warnings for process.getBuiltinModule / process.cwd - Load the key set with a 5s timeout - Rethrow framework control-flow errors instead of wrapping them - SvelteKit: render the page without flag values when encryption fails - Document that the fallback without a secret is silent Co-Authored-By: Claude Code <noreply@anthropic.com>
Co-Authored-By: Claude Code <noreply@anthropic.com>
…an decrypt Note that decryptFlagValues, encryptFlagDefinitions and decryptFlagDefinitions work only with a FLAGS_SECRET. Co-Authored-By: Claude Code <noreply@anthropic.com>
This branch was successfully deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
encryptFlagValuesthrows withoutFLAGS_SECRET, so a project needs a secret just to keep its flag values confidential.flags-explorer-api-decrypt).standardbranch ([flags] FlagValues: projectIds in the protected header, flags-keys JWKS #575) tomain, with the signature ofencryptFlagValuesunchanged.What
FLAGS_SECRET), nothing changes.encryptFlagValuesencrypts with the public key fromhttps://keys.vercel-flags.com/.well-known/jwks.json(ECDH-ES, A256GCM,projectIdsandkidin the protected header,pur: flag-values,ver: 1,aud: vercel:flag-values). This is the format that@api/flag-valuesdecrypts.VERCEL_PROJECT_ID, theVERCEL_OIDC_TOKENofvercel env pull, or.vercel/project.json.createHandleandencryptFlagValuesno longer require a secret. Without one, thedata-flag-valuesof a page use the public key, the overrides cookie is ignored,/.well-known/vercel/flagsresponds with 401, and precompute still requires a secret.Validation
flag-values-platform.test.tscover the token format, finding the project ID, key caching and rotation, the error cooldown, and that a setFLAGS_SECRETis still used.without-secret.test.tscovers SvelteKit'screateHandleandencryptFlagValueswithout a secret.🤖 Generated with Claude Code