How they are stored
Values are encrypted with AES-256-GCM before touching the database, never appear in logs, and are never returned in plaintext after creation — the dashboard shows only the key and a mask. Changes are recorded in the audit log (key name only, never the value).
Managing variables
Dashboard: project page, Environment Variables tab. API: GET/POST /api/v1/projects/:id/env and DELETE /api/v1/projects/:id/env/:key (scopes env:read / env:write). Targets: all environments, production or preview.
curl -X POST https://<host>/api/v1/projects/<id>/env \
-H "Authorization: Bearer sd_live_..." \
-H "Content-Type: application/json" \
-d '{"key":"DATABASE_URL","value":"...","target":"production"}'Build-time variables
Because builds run on your machine in the current model, build-time variables come from your local environment (your .env). Platform-stored variables are injected into server-side runtimes as cloud architectures roll out.