Vercel
Security & compliance
Preview deployments publicly accessible with staging data signals
Part of the Preview deploy safety check · fix arrives as a guide
What it is
Preview deployments are publicly accessible while the project shows signs of using staging or production-like data.
Why it matters
Preview URLs are unauthenticated and guessable enough to be found. An unreleased feature, or a staging dataset carrying real records, is then a public page nobody knows is public.
How to fix it
Turn on Vercel Authentication so previews require a team login, and confirm the preview environment points at a seeded database rather than a copy of production.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.