Vercel deploys your app with a git push, and that is wonderful, but every convenience hides a security decision you make without noticing. These are the points to watch when you launch there.
Environment variables and the public prefix
Vercel distinguishes server and client variables. In frameworks like Next.js, anything with a public prefix (for example NEXT_PUBLIC_) is baked into the bundle and travels to the browser. Keep only what you do not mind showing there. Private keys go without the prefix and are used only on the server. A slip here leaks tokens permanently.
Preview deployments are public
Every branch and pull request generates a preview URL. By default those URLs are reachable by anyone who knows them, and they often point at real data or test-environment keys. Do not treat them as private: if your preview connects to a database with sensitive data, protect access or use fake data.
Security headers
Vercel serves HTTPS out of the box, but it does not add defensive headers for you. Configure Strict-Transport-Security, X-Content-Type-Options, X-Frame-Options and a Content-Security-Policy in your project. Without them your app is more exposed to clickjacking and script injection, even if the browser padlock looks green.
Source maps that reveal your code
Many builds ship source maps to production. That lets anyone reconstruct your original code from the browser, comments and internal structure included. Sometimes it reveals endpoints or logic you thought was hidden. Decide consciously whether to publish them; for most apps, turn them off in production.
Files and endpoints that should not be there
Check that .env, .git, backups or manifests like package.json are not reachable. Also check for debug endpoints or unauthenticated API routes you left for testing and forgot to remove. What works locally keeps working in production, for you and for anyone else.
Scanaris checks it in 30 seconds
Scanaris scans your Vercel deployment non-intrusively: HTTP headers, cookies, TLS, reachable sensitive files, secrets in the JavaScript and CORS. It only reads what is already public, it attacks nothing. Every finding comes with a prompt ready to paste into your AI to fix it. Run it after every important deploy and launch with peace of mind.