Are Vercel preview deployments secure?

Vercel preview deployments are publicly accessible by default, meaning anyone with the URL can view them. This can expose unreleased features, staging data, or internal tools to the public. Vercel offers Deployment Protection which restricts access to preview deployments using Vercel Authentication or password protection on Pro and Enterprise plans. You can configure Standard Protection to require authentication for all preview deployments automatically. If you submit an authorized preview URL, UNPWNED can assess its externally observable access and exposure signals; it does not enumerate every Vercel preview.