Vercel Security Posture

A cloud platform for static sites and Serverless Functions.

Vercel Security Overview

Vercel provides automatic HTTPS and DDoS mitigation, but application-layer security headers (like X-Frame-Options or CSP) are not applied by default. These must be defined in vercel.json or the framework configuration.

Security Checks

HTTPS (pass)

TLS certificates are automatically provisioned and renewed via Let's Encrypt.

Application Headers (warn)

Vercel does not automatically inject Strict-Transport-Security or X-Content-Type-Options.

Preview Environments (warn)

Preview URLs are accessible publicly by default unless Vercel Authentication or password protection is explicitly enabled.

Run a Security Audit

These technical checks are informational heuristics, not a guarantee of security or compliance. Passing a scan does not guarantee protection against zero-days or application logic flaws. Always conduct independent professional audits.

What an Automated Check Can Verify

A public scan can inspect the TLS certificate, DNS records, HTTP response headers, and JavaScript files that Vercel serves to an ordinary visitor. It can flag exposed secret patterns and missing defensive controls, but it cannot prove that an application is secure or inspect private source code, access policies, database rules, or authenticated workflows.

Manual Review Still Required

Review authentication and authorization paths, dependency and supply-chain alerts, server-side secret storage, logging, backups, and incident response separately. Validate every automated finding before changing production. Re-run the public scan after deployment because CDN behavior, environment configuration, and framework upgrades can change what users receive.