Vercel pre-launch checklist

26 checks in the order we run them, most severe first. Each one has a self-check you can do in the Vercel console and your browser, and a fix direction. Free to use; nothing to sign up for.

Download .md

Defaults referenced come from Vercel's documentation, verified 2026-09-21, on the Vercel hub.

Secrets and keys
- NEXT_PUBLIC_ prefix on a secret
  In your hosting dashboard (Vercel: Project, Settings, Environment Variables) or your .env files, list every variable whose name starts with NEXT_PUBLIC_.
  Critical
- Secrets committed to the code repository
  Open your project on GitHub (or the code view in your builder) and look at the file list for .env, .env.local, .env.production, serviceAccountKey.json or firebase-adminsdk files.
  Critical
- Service-role key shipped in the browser bundle
  Open your live app in Chrome, right-click anywhere and choose Inspect, then open the Sources tab.
  Critical
- Third-party API key in the JavaScript bundle
  Open your live app in Chrome, right-click, choose Inspect, then open the Sources tab.
  High
- Secrets and internals in error messages and logs
  Open your live app, right-click, choose Inspect, then the Network tab. Trigger an error on purpose: submit a form with a field left blank, or visit an address like /api/anything-made-up.
  High
Login and permissions
- Admin routes without any login check
  Open a private browsing window so you are signed out.
  Critical
- Authorization enforced only in the browser
  Sign in as a normal user and open developer tools (right-click, Inspect), then the Network tab.
  Critical
- Password reset links that never expire
  Request a password reset for your own test account and keep the email.
  High
- Sessions that survive logout and password changes
  Sign in, open developer tools (right-click, Inspect), go to the Network tab and use Copy as cURL on a request that returns your account data.
  High
Payments
- Stripe webhook accepted without signature verification
  In the Stripe Dashboard, open Developers, then Webhooks, and copy the endpoint URL your app uses. It usually ends in something like /api/stripe/webhook or /functions/v1/stripe-webhook.
  Critical
- Stripe test keys in production
  Open your live app's checkout, press F12, select the Network tab, and start a checkout. Look for requests to stripe.com or js.stripe.com and read their URLs and payloads for a key beginning pk_test_ or a session ID beginning cs_test_.
  High
AI features
- LLM API key exposed to the client
  Open your live app, press F12, select the Network tab, and use the AI feature once.
  Critical
- No output validation before actions
  List the things your AI feature can do beyond replying with text: run queries, call APIs, send messages, change records, fetch URLs, run code.
  Critical
- No spend cap on model calls
  Sign in to your model provider's console and open the billing or limits page (OpenAI: Limits; Anthropic: Settings, then Billing). Note whether a monthly spend limit and a spend alert are set.
  High
- Prompt injection through user content
  List every place where text from a user, a webpage, an uploaded file or an email reaches the model: chat boxes, ticket forms, document upload, URL summarisers.
  High
- Unbounded input length to the model
  Open the AI feature in your app and paste an unusually long text, for example a whole book chapter copied several times, then submit.
  Medium
Deploy and config
- AI agent with production credentials
  Open the folder the agent works in and look for .env, .env.local or similar files; note whether any value starts with sk_live_, contains the word prod, or is a service-role or admin key.
  Critical
- CORS open to any origin with credentials
  Sign in to the live app, open browser devtools, go to the Network tab and click any request to your API.
  High
- Debug mode left on in production
  On the live site, open a page address that does not exist, then open an API route with a broken parameter, for example a letter where an id is expected.
  Medium
- Missing security headers
  Open your published app in Chrome or Firefox, press F12 and choose the Network tab.
  Medium
- No automated checks before deploy
  Open the project's GitHub repository; if the builder has a GitHub sync, connect it first so the code is visible there.
  Medium
- Every change goes straight to production
  Open your hosting dashboard (Vercel: the Deployments tab) or the builder's publish panel and look at the recent deployments.
  Medium
Reliability
- No rate limiting on sensitive routes
  Open your app's login or "forgot password" page in Chrome, press F12 and choose the Network tab.
  High
- Background jobs that fail silently
  List every scheduled or background task your app has: on Vercel open Settings then Cron Jobs; on Supabase open Integrations then Cron, and Edge Functions; on Replit look for a Scheduled deployment.
  Medium
- Retries with no pause and no cap
  Open your app in Chrome, press F12 and choose the Network tab.
  Medium
Performance
- List endpoints that return everything
  Open your app's main list page in Chrome, press F12, choose the Network tab, filter by "Fetch/XHR" and reload.
  Medium

Questions

vercel security checklist

The list above: 26 checks across 7 categories, most severe first. Each links to a page with what the issue looks like, a self-check and a fix direction. Download the Markdown file to tick items off in your own notes.

can i use this checklist without buying anything

Yes. That is the point of publishing it. If you run every self-check and fix what you find, you have done most of what the security sweep does. What our test adds is a second account, scripts that enumerate everything, and a written report you can show someone.

Prefer someone else to run it: the security sweep covers the critical items in 24 hours; the pre-launch check covers the full list. Or run the self-check tool.

Vercel pre-launch checklist

Secrets and keys

Login and permissions

Payments

AI features

Deploy and config

Reliability

Performance

Questions