Is Vercel secure by default?

Vercel provides a secure hosting infrastructure with automatic HTTPS, DDoS protection, and edge network security. However, Vercel does not add security headers like Content-Security-Policy, X-Frame-Options, or Permissions-Policy by default. Developers must configure these headers manually through vercel.json, next.config.js, or middleware. Environment variables prefixed with NEXT_PUBLIC_ are exposed to the browser, which is a common source of accidental secret leaks. UNPWNED tests your Vercel deployment for missing security headers and exposed secrets to ensure your application follows security best practices.