Secure your Vercel deployments with these essential practices. From environment variables to preview protection.
Verify your app follows these best practices automatically.
Vercel handles much of the infrastructure security, but application security is your responsibility. These practices help you deploy securely on Vercel.
Never commit secrets to your repository. Use Vercel's environment variable management.
Add secrets in Vercel Dashboard → Settings → Environment Variables
Use different secrets for Development, Preview, and Production environments.
In Vercel Dashboard, set environment-specific values for each variable
Preview deployments are public by default. Protect them to prevent leaking unreleased features.
Enable Deployment Protection in Project Settings → Deployment Protection
Add CSP, HSTS, and other security headers via vercel.json or Next.js config.
Add headers configuration in next.config.js or vercel.json
Validate authentication and authorization in every API route and Server Action.
Check session/token validity and user permissions at the start of each route
Use Vercel Firewall to block malicious traffic and rate limit requests.
Configure rules in Vercel Dashboard → Firewall
NEXT_PUBLIC_ variables are exposed to the browser
Server-only secrets should never have the NEXT_PUBLIC_ prefix
Anyone with the URL can see unreleased features and test with staging data
Enable Deployment Protection for preview environments
Production keys used in development increase risk of exposure
Use different API keys and secrets for each environment
Following best practices is the first step. Verify your app is actually secure with a comprehensive security scan.
Scan Your App FreeYes, Vercel encrypts environment variables at rest and in transit. They're only exposed to your build and runtime processes. Just ensure you don't use NEXT_PUBLIC_ for secrets.
Add a headers config to next.config.js or vercel.json. Include Content-Security-Policy, X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security.
Vercel Analytics focuses on performance, not security. For security monitoring, use Vercel Firewall and integrate with a security monitoring service.
Last updated: January 2026