vercel

Vercel production-launch security checklist

Vercel handles TLS, CDN, and DDoS protection for free, but security headers, rate limiting, and CORS still need explicit code. This list covers the Vercel-specific gaps.

11 checks

Tick through each one

Click any item to open the detailed fix guide. The detector tag shows which scanner module flips the state pass or fail when you run a SafeToShip scan.

Paste this into Vercel

One prompt that runs the entire checklist as a code review pass.

Audit my Vercel deployment: confirm server-only env vars are not prefixed NEXT_PUBLIC_, verify Production env scope is distinct from Preview, ensure .env is not deployed at the site root, configure CSP/HSTS/X-Content-Type-Options via next.config.js headers function, set CSP per-request nonce via middleware (drop unsafe-inline), set poweredByHeader: false, allowlist /api/* CORS origins, set Secure+HttpOnly+SameSite on cookies, integrate @upstash/ratelimit on hot routes, enable Vercel password protection on Preview deployments if previews ever contain real data, and confirm HTTPS-only with no mixed content.

FAQ

Frequently asked questions

How do I scope env vars properly on Vercel?
In the Vercel dashboard, each env var has a checkbox per environment (Production, Preview, Development). Production secrets should NOT be checked for Preview, otherwise PR deploys can leak them.
Why use Vercel password protection on Preview?
Preview URLs are not indexed but are publicly accessible if shared. If your previews contain real customer data or unfinished features, password-protect them via Project Settings → Deployment Protection.

Per-issue depth

Fix guides for this checklist

Exposed .env file

An exposed .env file is a critical leak — it contains API keys, database URLs, and secrets. Here is why it happens in vibe-coded apps and how to lock it down.

Read more

Missing CSP header

A missing Content-Security-Policy header lets attackers inject scripts into your site. Here is what CSP does, why you need it, and how to add it in Next.js, Vercel, and Supabase apps.

Read more

CORS allows all origins

An Access-Control-Allow-Origin: * policy lets any site call your API. Sometimes that is fine, often it is a mistake. Here is how to decide and fix it.

Read more

Run the scan to confirm each check

60 seconds. Free. No account required.