Is Vercel secure by default?

Vercel provides a secure hosting infrastructure with automatic HTTPS, DDoS protection, and edge network security. However, Vercel does not add security headers like Content-Security-Policy, X-Frame-Options, or Permissions-Policy by default. Developers must configure these headers manually through vercel.json, next.config.js, or middleware. Environment variables prefixed with NEXT_PUBLIC_ are exposed to the browser, which is a common source of accidental secret leaks. UNPWNED checks externally observable security-header and secret-exposure signals; it does not certify complete Vercel or application security.