Question 1

Is Netlify secure by default?

Accepted Answer

Netlify provides a solid foundation with automatic HTTPS via Let's Encrypt and DDoS protection, but many security features require manual configuration. Security headers like Content-Security-Policy are not added by default, environment variables can be exposed if build logs are public, and serverless functions lack built-in authentication or rate limiting. Netlify deploy previews can also expose staging content to anyone with the URL. The platform handles infrastructure security well but application-level security is entirely the developer's responsibility. UNPWNED checks your Netlify deployment for missing security headers, exposed configurations, and function security.

Question 2

Does Netlify add security headers?

Accepted Answer

Netlify does not add security headers automatically. You must configure them manually through a _headers file or netlify.toml configuration. Without explicit configuration, your Netlify site will be missing Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, Permissions-Policy, and Referrer-Policy headers. These missing headers leave your site vulnerable to XSS attacks, clickjacking, and MIME-type sniffing. Many developers deploying to Netlify skip this step entirely. UNPWNED scans your Netlify deployment and reports exactly which security headers are missing with ready-to-use configuration snippets.

Question 3

Are Netlify environment variables safe?

Accepted Answer

Netlify environment variables are generally secure at runtime but can leak through several vectors. Build logs may expose variable values if your build process echoes them. Variables prefixed with certain framework conventions like NEXT_PUBLIC_ or VITE_ are bundled into client-side code and visible to anyone. Deploy previews and branch deploys share the same environment variables unless scoped, which can expose production secrets in preview deployments. Always scope sensitive variables to production only and never prefix secrets with client-side framework prefixes. UNPWNED checks for exposed environment variables and secrets in your deployed application.

Question 4

How to secure a Netlify site?

Accepted Answer

Add a _headers file or netlify.toml with comprehensive security headers including Content-Security-Policy, Strict-Transport-Security, and X-Content-Type-Options. Scope environment variables to specific deploy contexts so production secrets are not exposed in preview deploys. Enable Netlify identity or add authentication to serverless functions that handle sensitive operations. Configure redirect rules to prevent open redirects. Disable public build logs if they might contain sensitive output. Add rate limiting through Netlify Edge Functions or a CDN like Cloudflare. UNPWNED provides a full security audit of your Netlify deployment with specific fix instructions.

Question 5

Are Netlify Functions secure?

Accepted Answer

Netlify Functions (serverless) do not include built-in authentication, rate limiting, or input validation. Every function endpoint is publicly accessible by default at /.netlify/functions/function-name, and any deployed function can be called by anyone. Without explicit security measures, functions are vulnerable to abuse, data extraction, and denial-of-service. You must implement your own authentication checks, input validation, and rate limiting in each function. UNPWNED detects exposed serverless function endpoints and tests them for common vulnerabilities including missing authentication and information disclosure.

Question 6

Does Netlify expose source code?

Accepted Answer

Netlify can expose source code through several paths. Source maps, if included in the production build, allow anyone to reconstruct your original source code including comments and internal logic. The .netlify directory and certain build artifacts may be accessible if not properly excluded. Public deploy logs can reveal project structure and build commands. Additionally, Netlify deploy previews are accessible via predictable URLs, potentially exposing development code. Always disable source maps in production builds, check that build artifacts are not publicly served, and restrict deploy preview access. UNPWNED scans for exposed source maps, build artifacts, and sensitive files.

Question 7

Can Netlify deploy previews be exploited?

Accepted Answer

Yes, Netlify deploy previews create publicly accessible URLs for every branch and pull request by default. These previews can expose unfinished features, debug interfaces, test credentials, and staging configurations to anyone who discovers or guesses the URL. If your previews use production environment variables, they may connect to live databases and services. Attackers can find preview URLs through GitHub pull request links, DNS records, or URL pattern enumeration. Restrict preview access using Netlify password protection or configure separate environment variable scopes for previews. UNPWNED helps you identify what is publicly exposed across all your deployment URLs.

Question 8

How does Netlify compare to Vercel for security?

Accepted Answer

Both Netlify and Vercel provide automatic HTTPS, DDoS protection, and edge network security. Neither platform adds security headers by default, both require manual configuration. Vercel offers built-in authentication for preview deployments on Team plans, while Netlify deploy previews are public by default. Netlify uses a _headers file for header configuration while Vercel uses next.config or middleware. Both have serverless functions that are publicly accessible without built-in auth. The security of your application depends on your configuration, not the platform choice. UNPWNED scans your deployment on either platform with the same comprehensive security checks.

Question 9

Does Netlify support rate limiting?

Accepted Answer

Netlify does not offer built-in rate limiting for sites or functions. Your API endpoints and serverless functions can receive unlimited requests without any throttling. This leaves your application vulnerable to brute-force attacks, credential stuffing, API abuse, and resource exhaustion. You can implement rate limiting through Netlify Edge Functions using in-memory counters, but these do not persist across function instances. For production rate limiting, you need an external solution like Cloudflare, a Redis-based rate limiter, or a dedicated API gateway. UNPWNED checks whether your endpoints have rate limiting protection and reports unprotected routes.

Question 10

What security testing should I do for a Netlify site?

Accepted Answer

Check that security headers are properly configured in your _headers file or netlify.toml. Verify that environment variables are scoped correctly and not leaked in client bundles or build logs. Test all serverless functions for authentication, authorization, and input validation. Confirm that source maps are excluded from production builds. Check deploy preview access restrictions. Verify that redirect rules do not create open redirects. Test CORS configuration on API endpoints. Ensure forms with Netlify Forms enabled have spam protection. UNPWNED runs all these checks automatically in a single scan and provides a prioritized list of fixes with actionable remediation steps.

Netlify Security Questions