Exposed .env files and debug endpoints in Vercel
Set environment variables in the project settings, scoped to the environments that need them. Do not commit them for "convenience." If the host offers a way to mark a variable sensitive so the dashboard stops showing the value, use it.
Fix for Vercel
Set environment variables in the project settings, scoped to the environments that need them. Do not commit them for "convenience." If the host offers a way to mark a variable sensitive so the dashboard stops showing the value, use it. Confirm the current control in Vercel's environment variable docs rather than assuming a button label.
Turn off verbose logging of request bodies on auth and webhook routes.
The five-minute check, the other platforms, and the agent prompt are on the full guide. More Vercel fixes are on the Vercel page.