varlock treats any undeclared env var as secret, and the page renders blank

varlock's leak scanner treats any environment variable it has not been told about as sensitive. If one of those values ends up in a page, varlock refuses the response, and what you see is a blank page.

In Replicator, .env.schema did not declare VERCEL_ENV. The moment SvelteKit tried to include its value in the HTML sent to the browser, varlock treated it as a leaked secret and refused every response. The browser showed nothing. There was no build error; the only signal was DETECTED LEAKED SENSITIVE CONFIG - VERCEL_ENV in the Vite console, easy to miss when you are looking at a blank tab. A platform variable none of our code considered secret had been treated as one by default.

The fix was to declare VERCEL_ENV, and VERCEL_PROJECT_PRODUCTION_URL for the same reason, as @optional in the schema. Because the file's header sets @defaultSensitive=false, declaring them was enough for varlock to treat them as known, non-sensitive values that may appear in output.

The general rule: declare every platform-injected variable (Vercel's system variables, framework internals) in the schema as soon as anything in the bundle references it, even if your own code never reads it. An undeclared variable defaults to maximally cautious, and that caution fails in the browser.

Receipt: Replicator v3.66.5 (.env.schema, VERCEL_ENV; FINDINGS.md, "varlock, environments and secrets").