Configuration review · Vercel / Next.js
Vercel security configuration and Next.js deployment boundary review
Not “is Vercel secure?” — your project’s configuration, and the boundary with the Next.js code on top of it. Are production keys in Preview? Can anyone open a preview URL? Can a per-user response end up cached on the CDN? We check the dashboard settings against the repository.
Pricing: Spot review From $680 / Standard audit From $1,900
Vercel settings alone do not make an app secure. The Firewall and Deployment Protection guard the front door; an authorization mistake still has to be fixed in the app’s code. Both are reviewed.
Scope
What gets checked
Checked against Vercel’s official documentation, feature names and defaults as of October 2026. Where a feature is not on your plan, the review proposes an alternative.
Environment variables and environment isolation
- Overlap between Production, Preview and Development values (no production keys in Preview)
- Config vs. Secret (write-only) types, and separate production secret values
- Whether
NEXT_PUBLIC_variables end up inlined into code shipped to the browser - Whether OIDC Federation can replace long-lived keys for AWS / GCP
Deployment protection and Git
- Deployment Protection scope (new projects default to Standard Protection, which covers everything except production domains)
- Managing Protection Bypass for Automation secrets and how Shareable Links are handed out
- Pull requests from forks (Git Fork Protection) and requiring verified commits
- Who can see build logs and source
The Next.js deployment boundary
- Whether Server Actions and Route Handlers are treated as public APIs, with authentication and authorization checked in each
- Whether authorization relies on Proxy (formerly middleware) alone
Cache-Controlthat could let a per-user response be cached on the CDN- CSP and other security headers (HSTS is the one Vercel sets by default)
Edge defenses and operations
- Firewall custom rules, rate limiting and the Attack Mode runbook
- Protecting cron with
CRON_SECRET, and jobs that survive running twice - Webhook signature verification
- Secrets or personal data written to logs, retention and drains
Timing
When to review it
Before sharing preview URLs outside the team
Decide the protection scope and the sharing mechanism first.
Before production database or payment keys go in
Separating which value lives in which environment is cheapest at the start.
When adding cron jobs or webhooks
Verify a secret so the URL is not callable by anyone.
When the team or contractors grow
Revisit who can change production settings and who can read the logs.
What it is not
- Not an assessment of Vercel’s own infrastructure or platform. The subject is your configuration and code.
- No design that assumes Enterprise-only features (Trusted IPs, audit logs and so on) when you are on another plan.
- No load testing or DDoS simulation.
Who
Who reviews your app
Audits are taken on by Tomoda Hinata, a freelance full-stack engineer. Judge by the published research, tools and delivered work below, not by a title.
A field study of Supabase RLS (1,000 public repositories)
A static analysis of public repositories: 9.2% (91) of the 994 that ship RLS had a policy that checks sign-in but does not narrow rows to their owner — published after checking all 235 such policies by hand.
Aegis, an open-source security toolkit
Scanners and defensive building blocks for Next.js / Supabase, published under the MIT license. Part of the automated detection used in an audit is something anyone can run locally.
A METI Minister's Award–winning B2B SaaS (lumber distribution)
SoloAll 221 APIs with 0 missing-authorization findings, proven across 4 rounds of self-conducted security review (static review → live testing → penetration testing), with every critical finding, including cross-tenant personal-data exposure, fixed.
An internal AI platform for a broadcaster
TeamEncrypted personal data, audit logs, a WAF and key-less CI/CD built into the initial design rather than bolted on.
Pricing
What it costs
Delivered within the existing audit tiers. Prices are “from” anchors; the number of projects, team structure and whether app code is included change the quote.
Spot review
You want your Vercel settings (env vars, protection scope, Git, Firewall, cron) inventoried and the risks ranked
Turnaround: ~1 week
From $680scoped per project
Standard audit
You also want the Next.js side reviewed: authorization in Server Actions and Route Handlers, caching and the deployment boundary
Turnaround: ~2–3 weeks
From $1,900scoped per project
If you also want the settings fixed or the headers and Firewall rules implemented, we scope and quote it on the call.
See the specialist audit of the app side (Next.js × Supabase authorization and RLS)
Frequently asked questions
If we deploy on Vercel, doesn’t Vercel take care of security?
Infrastructure and DDoS mitigation are on Vercel’s side, but under the shared responsibility model in its docs, environment variables, access control, handling sensitive data and the application code are yours. This review covers that side.
What do you need from us?
An invitation to your Vercel team with permission to view settings, or a screen-share where we go through them together. Read access to the repository lets the review cover the Next.js side too. You never need to hand over environment variable values. An NDA can be signed before our first call.
What do we receive?
A prioritized report of each setting’s current state, the risk and the recommendation — down to which setting on which screen to change, so your team can fix it in-house. If you want the changes made for you, we scope that on the call.
Can you review a project on the Hobby plan?
Yes. Plans differ in what is available, so the review separates what your plan can configure from what the code has to cover. It does not assume an upgrade.
How much does it cost?
An inventory of your Vercel settings with a ranked report fits the spot review (from $680); including Next.js authorization and the deployment boundary fits the standard audit (from $1,900). The number of projects and the scope change the quote.
Set the scope in 30 minutes before opening every setting
Tell us how many projects, which plan, and what must stay protected — production keys, customer data, previews — and we sort out where to start.
An NDA can be signed before our first call.