Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Vercel

CORS wide open in Vercel

highUpdated Oct 12, 2026

You can set headers in vercel.json or next.config.ts . A static header on /api/:path is the bug if those routes use cookies.

Fix for Vercel

You can set headers in vercel.json or next.config.ts. A static * header on /api/:path* is the bug if those routes use cookies. Prefer the allowlist in code so Vary: Origin is correct.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Vercel fixes are on the Vercel page.