Can Vercel apps be hacked?

Vercel-Specific Attack Vectors

These are the paths attackers actually take into Vercel applications — not a generic OWASP list, but what automated scanners and security researchers find when they look at Vercel apps specifically, given the stack (Supabase (Postgres + RLS) as the database):

1. **Environment Variable Misconfiguration**: Secrets in wrong scope (Development vs Preview vs Production).

2. **Preview Deployment Exposure**: Preview URLs expose unreleased features without authentication.

3. **Missing Security Headers**: Deployed sites without CSP, HSTS, or frame protection.

4. **Serverless Function Logging**: Secrets accidentally logged in function console output.

5. **Edge Function Security Gaps**: Edge functions with improper auth or CORS configuration.

**Supabase-Specific Risk**: Vercel apps typically ship with the public Supabase anon key embedded in frontend code. That is by design — but only works safely if Row Level Security is enabled on every table. Attackers routinely query Supabase endpoints directly using the anon key from your bundle. A single table without RLS is a full data leak.

How these issues get discovered

This isn't targeted — automated scanners run across the entire internet looking for known patterns, and Vercel apps surface like everything else. Supabase URLs follow a predictable pattern (`*.supabase.co`), making Vercel apps easy to fingerprint. Once identified, the scanner probes the specific vulnerability classes listed above.

What a security scan of a Vercel app looks at

• **Env Variable Security** — Check environment variable configuration and exposure.
• **Serverless Security** — Analyze serverless functions for vulnerabilities.
• **Headers Config** — Verify security headers in vercel.json.
• **Auth Protection** — Check authentication on protected routes.