Question 1

Is Vercel secure by default?

Accepted Answer

Vercel provides a secure hosting infrastructure with automatic HTTPS, DDoS protection, and edge network security. However, Vercel does not add security headers like Content-Security-Policy, X-Frame-Options, or Permissions-Policy by default. Developers must configure these headers manually through vercel.json, next.config.js, or middleware. Environment variables prefixed with NEXT_PUBLIC_ are exposed to the browser, which is a common source of accidental secret leaks. UNPWNED tests your Vercel deployment for missing security headers and exposed secrets to ensure your application follows security best practices.

Question 2

Does Vercel add security headers automatically?

Accepted Answer

Vercel adds Strict-Transport-Security (HSTS) and X-Content-Type-Options headers automatically, but does not add Content-Security-Policy, Permissions-Policy, X-Frame-Options, or Referrer-Policy by default. These headers must be configured by the developer using middleware, next.config.js headers configuration, or a vercel.json headers section. The Next.js framework itself adds X-Content-Type-Options: nosniff by default through its own configuration. Missing security headers is one of the most common findings on Vercel-hosted applications. UNPWNED checks all critical security headers on your deployment and reports which ones are missing with exact configuration snippets to fix them.

Question 3

How do I add a Content Security Policy on Vercel?

Accepted Answer

The recommended way to add CSP on Vercel with Next.js is through middleware.ts, which allows you to set the header dynamically on every request. You can also use the headers configuration in next.config.js for static CSP values or vercel.json for non-Next.js projects. A proper CSP should restrict script-src, style-src, img-src, and connect-src to only the domains your application needs. Using nonces for inline scripts is the most secure approach and requires middleware to generate a unique nonce per request. UNPWNED analyzes your CSP policy for weaknesses like unsafe-inline, unsafe-eval, or overly broad wildcard domains.

Question 4

Are Vercel preview deployments secure?

Accepted Answer

Vercel preview deployments are publicly accessible by default, meaning anyone with the URL can view them. This can expose unreleased features, staging data, or internal tools to the public. Vercel offers Deployment Protection which restricts access to preview deployments using Vercel Authentication or password protection on Pro and Enterprise plans. You can configure Standard Protection to require authentication for all preview deployments automatically. UNPWNED checks whether your preview deployments are properly protected and alerts you if sensitive content is publicly accessible.

Question 5

Are NEXT_PUBLIC_ environment variables a security risk?

Accepted Answer

Environment variables prefixed with NEXT_PUBLIC_ are bundled into the client-side JavaScript and are visible to anyone who inspects your page source or network requests. This is by design in Next.js to allow client-side code to access configuration values. However, developers sometimes accidentally prefix sensitive values like API secrets, database connection strings, or private keys with NEXT_PUBLIC_, exposing them publicly. Only values that are safe to be public, such as analytics IDs or public API endpoints, should use this prefix. UNPWNED scans your deployed application for exposed environment variables and flags any that appear to contain sensitive credentials.

Question 6

How secure are Vercel Serverless Functions?

Accepted Answer

Vercel Serverless Functions run in isolated AWS Lambda environments and have access to server-side environment variables that are not exposed to the client. However, functions are publicly accessible by default at their API route paths and do not include built-in authentication or rate limiting. Developers must implement their own authentication checks, input validation, and abuse prevention within each function. Functions that access databases or external APIs should validate all user input to prevent injection attacks. UNPWNED tests your serverless function endpoints for common vulnerabilities including missing authentication, input validation bypasses, and information disclosure.

Question 7

How do I secure my Vercel deployment?

Accepted Answer

Start by adding security headers through middleware or next.config.js, including Content-Security-Policy, Permissions-Policy, and Referrer-Policy. Enable Deployment Protection for preview deployments to prevent unauthorized access to staging environments. Audit your environment variables to ensure no secrets are prefixed with NEXT_PUBLIC_ and use server-side API routes to proxy sensitive API calls. Implement rate limiting on API routes and enable Vercel Firewall rules if available on your plan. UNPWNED provides a comprehensive security assessment of your Vercel deployment and generates a prioritized list of fixes to harden your application.

Question 8

How does Vercel security compare to Netlify security?

Accepted Answer

Both Vercel and Netlify provide automatic HTTPS, DDoS protection, and CDN-level security as part of their hosting infrastructure. Neither platform adds comprehensive security headers by default, requiring developers to configure them manually. Vercel offers Deployment Protection and Vercel Firewall on Pro plans, while Netlify provides password protection and role-based access control. Both platforms run serverless functions on AWS Lambda with similar isolation guarantees. The primary security differences come from developer configuration rather than platform infrastructure. UNPWNED scans applications hosted on both platforms and reports platform-specific security recommendations.

Question 9

What are the most common Vercel security mistakes?

Accepted Answer

The most common mistake is not adding security headers, particularly Content-Security-Policy, which leaves the application vulnerable to cross-site scripting attacks. Developers frequently expose secrets through NEXT_PUBLIC_ environment variables or by committing .env files to public repositories. Leaving preview deployments publicly accessible exposes unreleased features and staging data to anyone with the URL. Many applications also lack rate limiting on API routes, making them vulnerable to brute-force attacks and abuse. UNPWNED detects all of these common issues and provides specific fix instructions for each vulnerability found in your Vercel deployment.

Question 10

What are the security best practices for Vercel?

Accepted Answer

Configure comprehensive security headers including CSP, Permissions-Policy, X-Frame-Options, and Referrer-Policy through middleware or next.config.js. Enable Deployment Protection on all preview deployments and restrict access to team members only. Keep all secrets in server-side environment variables without the NEXT_PUBLIC_ prefix and access them only through API routes. Implement rate limiting and input validation on all serverless functions, and use Vercel Firewall rules to block malicious traffic patterns. UNPWNED monitors your Vercel deployment continuously and alerts you when security configurations drift from best practices.

Vercel Security Questions