The hook
Securing Vercel deployments requires the active configuration of security features such as Deployment Protection and custom HTTP headers [S2][S3]. Relying on default settings may leave environments and users exposed to unauthorized access or client-side vulnerabilities [S2][S3].
What changed
Vercel provides specific mechanisms for Deployment Protection and custom header management to enhance the security posture of hosted applications [S2][S3]. These features enable developers to restrict environment access and enforce browser-level security policies [S2][S3].
Who is affected
Organizations using Vercel are affected if they have not configured Deployment Protection for their environments or defined custom security headers for their applications [S2][S3]. This is particularly critical for teams managing sensitive data or private preview deployments [S2].
How the issue works
Vercel deployments may be accessible via generated URLs unless Deployment Protection is explicitly enabled to restrict access [S2]. Additionally, without custom header configurations, applications may lack essential security headers like Content Security Policy (CSP), which are not applied by default [S3].
What an attacker gets
An attacker could potentially access restricted preview environments if Deployment Protection is not active [S2]. The absence of security headers also increases the risk of successful client-side attacks, as the browser lacks the instructions necessary to block malicious activities [S3].
How FixVibe tests for it
FixVibe now maps this research topic to two shipped passive checks. headers.vercel-deployment-security-backfill flags Vercel-generated *.vercel.app deployment URLs only when a normal unauthenticated request returns a 2xx/3xx response from the same generated host instead of a Vercel Authentication, SSO, password, or Deployment Protection challenge [S2]. headers.security-headers separately inspects the public production response for CSP, HSTS, X-Content-Type-Options, Referrer-Policy, Permissions-Policy, and clickjacking defenses configured through Vercel or the application [S3]. FixVibe does not brute-force deployment URLs or try to bypass protected previews.
What to fix
Enable Deployment Protection in the Vercel dashboard to secure preview and production environments [S2]. Furthermore, define and deploy custom security headers within the project configuration to protect users from common web-based attacks [S3].