Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Vercel

Secret keys shipped in the frontend in Vercel

criticalUpdated Oct 12, 2026

Put the secret in the project's environment variables for Production, Preview, and Development as needed. Do not prefix it with NEXT PUBLIC .

Fix for Vercel

Put the secret in the project's environment variables for Production, Preview, and Development as needed. Do not prefix it with NEXT_PUBLIC_. Redeploy after rotating. The old deployment keeps the old value until it is replaced.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Vercel fixes are on the Vercel page.