Security when deploying to Vercel
Vercel deploys with a git push, and every convenience hides a security decision: environment variables, reachable preview deployments, source maps and headers. Scan your deployment and confirm it.
Typical risks in Vercel
Misused public variables
Public-prefixed variables get baked into the bundle. Keep only what you do not mind showing there; private keys go without the prefix, server-side only.
Public preview deployments
Every branch generates a preview URL reachable by anyone who knows it, often wired to real data or keys. Do not treat them as private.
Source maps and headers
Vercel serves HTTPS but adds no defensive headers. And if you publish source maps, anyone rebuilds your code. Both are configured in the project.
Related checks
Does your Vercel app pass these checks?
Scan it free and get a fix prompt for every issue we find.
Scan my site free