Where passwords live

Find the kind of password you have, and the check tells you where it goes. If it's in two places, save it in both.

Rule set 2026-10-23 · Config download test 2026-10-26

PasswordBitwardenpeopleVercelas SecretAWSbackend
Your own loginsGoogle, Slack, Vercel, AppFolio✓
Shared team accountsTwilio console, shared admin logins✓
AppFolio robot loginsClara signs in as these. A person sometimes does too.✓✓
Keys the app usesTwilio, Stripe, ElevenLabs✓
Backend keysWhat Lambdas and workers read on their own✓

Never

✕ Save as Config in Vercel✕ Tick Development✕ Paste in Slack, email or AI chat✕ Send codes to a personal phone
Why Config isn't safe, even with two-factor

The Vercel website asks for two-factor before it shows a Config value. The command line doesn't. On 2026-10-26 we added a dummy Config variable to an empty project and downloaded it with vercel env pull, and it came back as plain text with no prompt. That download is exactly what a script or AI session on a laptop would run.

Secret values never come back, from the website, the API or the command line. That's why every Secret needs a Bitwarden copy. Lose the copy and the only way back is a password reset.

What each Vercel environment is for
EnvironmentWhat runs thereRobot password?
ProductionThe live app and robotYes
PreviewTest builds for each pull requestAllowed
DevelopmentSomeone's laptop, after downloading the variablesNever
How to rotate an AppFolio robot password
  1. Engineering pauses that robot's automatic sign-ins, so it can't retry the old password and lock the account.
  2. Click "Forgot password?" on the customer's AppFolio page. The reset email lands in the clara@ mailbox.
  3. Set the new password. Sign-in codes go to that customer's robot line in Twilio, and engineering can read them for you.
  4. Save it in Bitwarden first.
  5. In Vercel, edit the existing APPFOLIO_<CUSTOMER>_PASSWORD. Paste the same value with no spaces around it, keep it Secret, and leave Development unticked.
  6. Engineering redeploys the robot, turns sign-ins back on and runs one test sign-in. If it fails, re-check the paste. Don't keep retrying.
Robot logins we run today
CustomerRobot loginVercel nameCodes go to
Western Slopeclara@propflowai.coAPPFOLIO_WESTERNSLOPEPM_*Our line ending 3970
JP&Coclara+jpco@propflowai.coAPPFOLIO_JPCO_*Our line ending 6641
Situsclara+situs@propflowai.coAPPFOLIO_SITUSGROUP_*Our line ending 3404
PropFlow Docs