Vercel
Security & compliance
Releases
Code quality
Cost
Preview deploy safety
Preview URLs are public until you make them otherwise.
Overview
Reads your Vercel project configuration and bundler settings for the gap between how preview deployments are treated and how they are actually exposed: who can reach them, which secrets they hold, and what they publish.
What it looks for
- Preview deployments publicly reachable while serving staging data
- Production secrets present in preview environment scope
- productionBrowserSourceMaps enabled, publishing readable source
- Source maps with no environment guard in bundler config
- No noindex on preview environments, and debug logging with no production guard
Why it matters
Preview URLs are guessable, unauthenticated, and indexable by default, which makes an unreleased feature or a staging dataset a public page. Production secrets scoped into preview means every PR build holds them.
Rules in this check
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.