vercel-security-basics

# Vercel Security Basics ## Overview Secure Vercel deployments with proper secret management, security headers, deployment protection, and access token hygiene. Covers environment variable scoping, Content Security Policy, and preventing common secret exposure patterns. ## Prerequisites - Vercel CLI installed and authenticated - Access to Vercel dashboard - Understanding of HTTP security headers ## Instructions ### Step 1: Secret Management with Environment Variables ```bash # Add secrets scoped to specific environments vercel env add DATABASE_URL production vercel env add DATABASE_URL preview vercel env add DATABASE_URL development # Use 'sensitive' type — values hidden in dashboard and logs vercel env add API_SECRET production --sensitive # Via REST API curl -X POST "https://api.vercel.com/v9/projects/my-app/env" \ -H "Authorization: Bearer $VERCEL_TOKEN" \ -H "Content-Type: application/json" \ -d '{ "key": "API_SECRET", "value": "sk-secret-value", "type": "sensitive", "target": ["production"] }' ``` **Critical rule:** Never prefix secrets with `NEXT_PUBLIC_`. Variables starting with `NEXT_PUBLIC_` are inlined into the client JavaScript bundle and visible to anyone. ### Step 2: Security Headers via vercel.json ```json { "headers": [ { "source": "/(.*)", "headers": [ { "key": "X-Content-Type-Options", "value": "nosniff" }, { "key": "X-Frame-Options", "value": "DENY" }, { "key": "X-XSS-Protection", "val...