Security on Vercel: what to check
Vercel hosts front ends and serverless functions, often for Next.js apps but also for Vite and other static builds. HTTPS and certificates are handled for you.
What remains yours is what your app sends: its headers, its environment variables and the files you publish.
What to check on Vercel
-
Are your security headers set?
Add headers under "headers" in vercel.json, or in your framework's own configuration.
-
Are secret API keys exposed in your front end?
Keep secrets in serverless functions, never in variables built into the front end.
-
Is your site publishing its source maps?
Check that production source maps are not part of the published build.
-
Can someone send email as your domain?
If you use your own domain, its SPF and DMARC records are yours to set, wherever the app is hosted.
Where settings go on Vercel
- Security headers
- On Vercel, add it under "headers" in vercel.json for the source "/(.*)".
- Secret keys
- Variables starting with NEXT_PUBLIC_ are built into the public bundle. Rename the variable without that prefix and use it only in server code: a Route Handler, a Server Action or a server component.
Common questions
Does Vercel set security headers?
Vercel handles HTTPS for you, but headers such as Content-Security-Policy and frame protection are up to you, in vercel.json or your framework.
Are Vercel environment variables secret?
They are stored privately, but a variable your framework builds into the front end, such as one starting NEXT_PUBLIC_ or VITE_, becomes public.