Does Vercel add security headers automatically?

Vercel adds Strict-Transport-Security (HSTS) and X-Content-Type-Options headers automatically, but does not add Content-Security-Policy, Permissions-Policy, X-Frame-Options, or Referrer-Policy by default. These headers must be configured by the developer using middleware, next.config.js headers configuration, or a vercel.json headers section. The Next.js framework itself adds X-Content-Type-Options: nosniff by default through its own configuration. Missing security headers is one of the most common findings on Vercel-hosted applications. UNPWNED assesses its configured security-header set and reports observed gaps. Paid reports add configuration guidance.