Sensitive values
Mark a variable sensitive so Gigadrive Network stops handing the value back, and learn what you can still do with it.
Every environment variable is encrypted at rest, so the sensitive flag is not about storage. It changes who can read the value back: Gigadrive Network stops returning it to anyone, including you, while still delivering it to your build and to your Functions.
What changes
| Surface | Ordinary variable | Sensitive variable |
|---|---|---|
GET on the API and the SDK | value holds the string | value is null |
| Console variables table | Reveal toggle shows the value | Masked, no reveal or copy control, Secret badge |
gigadrive env list | KEY=value | KEY=*** |
gigadrive env pull and /env-vars/pull | Written to the file | Omitted, and counted in omittedSensitive |
| Build | Injected | Injected, and redacted from build logs |
| Function at runtime | Injected | Injected |
Builds get the plaintext because a framework build may reach a database or generate code from a credential. Every sensitive value is stripped from build logs and from build error output.
Where a sensitive variable can live
An application variable can only be sensitive when it is scoped to that application's production or preview environment. Marking an application-wide variable sensitive, or one on an environment you created yourself, returns 400 with Sensitive environment variables can only be set on production or preview environments. That rule is what keeps gigadrive env pull from ever writing a secret onto a developer's laptop.
On the CLI this means gigadrive env set --sensitive needs --env pointing at your production or preview environment id.
Rotating a value
Write the new value over the old one, then deploy again so running Functions pick it up.
import { GigadriveClient } from '@gigadrive/sdk';
const client = new GigadriveClient();
const applicationId = '0197b2f1-2f4a-7a0b-8a2d-222222222222';
const { items } = await client.applications.envVars.list(applicationId);
const existing = items.find((item) => item.key === 'DATABASE_URL' && item.sensitive);
if (!existing) throw new Error('DATABASE_URL is not set as a sensitive variable.');
await client.applications.envVars.update(applicationId, existing.id, {
value: 'postgres://app:4d7e0a55@db.example.com:5432/app',
});The CLI has no update command, so the second tab removes the row and sets it again, which gives the variable a new id. gigadrive env rm matches on the name or the id. When the same name exists on more than one environment, pass the id, which the SDK and the API return in the list response.
In the console, open the variable and leave the value field empty to keep the current value while you change something else. Anything you type replaces the secret.
There is no read-back
No console page, API route or SDK method returns a sensitive value after it is written. If you will need the string again, keep it in your password manager or secret store as well.
Audit log entries for these variables record the name and the sensitive flag, never the value, so a rotation is visible in Audit logs without exposing anything.