Sensitive Env Vars Should Be Default, Not Opt-In

I wrote a post earlier today about cleaning up after the Vercel breach. The cleanup itself is easy — ten minutes, a sequence of clicks, done. What's been bugging me all afternoon is a different question: Why is "sensitive" opt-in? When you add an env var to Vercel, it's not marked sensitive by defau