Skip to content
ShipSecurelySecurity reference
Menu

13 tools · 88 fixes · 22 incidents tracked · Updated Oct 13, 2026 · Sources: Supabase, GitHub, OWASP, Stripe + 9

Vercel

Cross-site scripting (XSS) in Vercel

highUpdated Oct 12, 2026

A header such as Content-Security-Policy on the deployment limits script sources. Set it in next.config or vercel.json .

Fix for Vercel

A header such as Content-Security-Policy on the deployment limits script sources. Set it in next.config or vercel.json. A CSP is a second layer. Remove the HTML sink first. See missing security headers.

The five-minute check, the other platforms, and the agent prompt are on the full guide. More Vercel fixes are on the Vercel page.