Does Vercel add security headers automatically?

Vercel adds Strict-Transport-Security (HSTS) and X-Content-Type-Options headers automatically, but does not add Content-Security-Policy, Permissions-Policy, X-Frame-Options, or Referrer-Policy by default. These headers must be configured by the developer using middleware, next.config.js headers configuration, or a vercel.json headers section. The Next.js framework itself adds X-Content-Type-Options: nosniff by default through its own configuration. Missing security headers is one of the most common findings on Vercel-hosted applications. UNPWNED checks all critical security headers on your deployment and reports which ones are missing with exact configuration snippets to fix them.