Vercel Security Review
Vercel security review for the deployments you forgot about, because Vercel makes deployment effortless. A secret named with NEXT_PUBLIC_ ships in the browser bundle, and an unprotected preview serves production data. CREST-certified testers, fixed price from £2,240, scoped in 24 hours.
- Unlimited retesting
- No rescheduling or cancellation fees
- Fixed quote within 24 hours
“I would highly recommend EJN Labs to any organisation seeking reliable, detailed, and well-managed penetration testing services, particularly for government or enterprise-level projects.”
“There wasn’t another company we could find that could deliver what we needed in the timeframe we needed. The client loved it, and we got instant ROI from the engagement.”
Preview deployments are the finding we raise most. Every pull request produces a live, publicly addressable deployment, and those deployments frequently carry production environment variables because that was the quickest way to make the preview useful. The result is production data behind a URL with no authentication.
Why the platform’s convenience is the risk
The failure modes are specific and repeatable. A secret named with NEXT_PUBLIC_ or another framework prefix. Deployment Protection set to None. Production credentials also scoped to the Preview environment. Config-type variables holding API keys that every project member can read. Source maps served from production with no protection.
Frameworks use a prefix such as NEXT_PUBLIC_ to expose variables to the browser, so anything carrying it is readable by every visitor. Config values stay readable to members with project access, and only Secret values are write-only after saving. Protection is set per project, and Password Protection is not available on Hobby. See Vercel’s Deployment Protection documentation.
We attack it as an anonymous visitor, then as a member of a different team. We load every preview URL, search the JavaScript bundles and .map files for secrets, and try to read production data through a preview. ISO 27001, SOC 2, PCI DSS and Cyber Essentials Plus audits accept manual penetration test evidence. Scan-only evidence is generally insufficient.
PREVIEWS, SECRETS + EDGE
What we actually pen test on a Vercel deployment
Manual pen testing across preview deployment exposure, environment variable handling, serverless and edge function behaviour, middleware enforcement and the build pipeline.
Preview deployment exposure
Whether preview and branch deployments are publicly reachable, what data and environment they carry, deployment protection settings, and whether historical deployment URLs remain live and indexable.
Environment variables and secrets
Which variables reach the client bundle, whether any secret carries a public prefix, secret handling in build logs, and what is retrievable from the deployed bundle or source maps.
Serverless and edge functions
Authorisation on each function, SSRF through server-side fetches, input handling, function-level rate limiting, and whether a function trusts headers that a client can set.
Middleware and access control
Whether middleware genuinely runs for every protected path, matcher configuration gaps, path normalisation and encoding bypasses, and header spoofing where middleware trusts a forwarded value.
Build and deployment pipeline
Repository and deployment integration permissions, who can trigger a production deployment, build-time secret exposure, and whether a pull request from a fork can reach secrets.
Headers, caching and rewrites
Security header configuration, cache-control on authenticated responses, edge caching of personalised content, and rewrite and redirect rules that expose an internal origin.
METHODOLOGY
Vercel Security Review: From Scope to Attestation
CREST-aligned methodology built on OWASP Web Security Testing Guide, OWASP ASVS, NIST SP 800-115, and PTES. Each finding maps to all four standards plus your specific compliance regime.
Reconnaissance
Application mapping, technology fingerprinting, content discovery, parameter enumeration, authentication-flow analysis, role-matrix construction.
Vulnerability Assessment
Authenticated and unauthenticated automated scanning across every user role, plus targeted manual checks for known weakness patterns.
Manual Exploitation
Hands-on testing by a CREST-certified pentester. Business-logic exploitation, chained vulnerabilities, privilege escalation, impact validation.
Reporting + Retest
Executive summary, technical report with CVSS scores and reproduction steps, walkthrough call, free retest after remediation, attestation letter.
CREDENTIALS
Verified Accreditations Auditors Accept
Every credential below is independently verifiable. UK procurement teams, FCA supervisors, ISO 27001 / SOC 2 auditors, and cyber insurance underwriters all recognise these standards.
GET YOUR QUOTE
Get a CREST Vercel pen test quote in 24 hours
A fixed-price quote back in one business day, from a named CREST assessor. No sales pipeline, no chasing.
- CREST and IASME accredited. Testing your auditors and clients already recognise.
- Fast-track testing within 24 hours where required. Free retest of every fix included.
- Live findings via your client portal, not a four-week PDF.
- Fixed price from £3,500 for a single-role, single-app scope, agreed up front. Most engagements run £5,000 and up. No day-rate surprises.
Dan WilcocksonFounder, CelloriUnder NDA Further named references available on a scoping call.
- We reply within one business day with a fixed-price quote from a named CREST assessor.
- You approve the scope and we book a start date, usually within 24 hours.
- Live findings land in your client portal as we test, with a free retest of every fix.
Get your fixed pen test quote in 24 hours
Quote request received
We will reply within one business day with your fixed-price quote from a named CREST assessor.
Your data stays with us. No newsletter signup.
or book a 20-min scoping call first
We reply within one business day. Your data stays with us. No newsletter signup.
COMPLIANCE READY
Reports Mapped to Every Framework
Findings are explicitly tagged to the relevant control reference. Your audit team submits the report directly without translation work.
ISO 27001:2022
Annex A.8.8 management of technical vulnerabilities plus A.5.15-5.18 and A.8.2-8.5 access control validation.
SOC 2 Type I & II
CC6 logical access, CC7 system operations, CC8 change management evidence.
PCI DSS
Requirement 11.4 application penetration testing across cardholder data environments, including ecommerce penetration testing for online retail platforms.
FCA SYSC
SYSC 4.1.1R, 6.1.1R, 13 mapped to each finding for FCA-regulated firms.
UK GDPR
Article 32 effectiveness testing, customer-data security controls, ICO-acceptable evidence.
Cyber Essentials Plus
Direct certification through our IASME body status, single-vendor delivery.
PRICING
Transparent Vercel Security Review Pricing
Pricing depends on app complexity, user-role count, business-logic depth, and integration surface. The day count flexes; the included deliverables stay the same across all engagements.
2 to 3 testing days
Single user role, basic CRUD application, marketing website with auth. Around 5 working days from kickoff to report.
Get a fixed quote3 to 4 testing days
Multi-role SaaS, business application with payment integration. Around 8 to 12 working days from kickoff to report.
Get a fixed quote4 to 6 testing days
Multi-tenant platform, complex authorisation matrix, integration-heavy applications. Around 15 to 20 working days from kickoff to report.
Get a fixed quotePart of Technologies We Pen Test. These are examples of the stacks we publish pages for, not a complete list. If yours is not here we still test it. Related pages:
BY SECTOR
Vercel Security Review for Your Sector
Sector-specialist scoping for UK businesses with sector-specific compliance regimes and threat models.
Fintech & FCA-Regulated
FCA SYSC, Open Banking FAPI 1.0, PSD2 SCA, payment-flow scrutiny, KYC/AML testing.
Fintech sector pageSaaS Companies
SOC 2 Type I & II evidence, multi-tenant boundaries, role escalation, customer-tenant isolation.
SaaS sector pageLaw Firms
SRA Cyber Standard, privileged data, conveyancing fraud defence, partner-tier procurement.
Law firm sector pageHealthcare
NHS DTAC, DSP Toolkit v6, UK GDPR Article 32, EHR systems, telehealth platforms.
Healthcare sector pageInsurance
FCA / PRA Operational Resilience, cyber underwriting, claims data, broker portals.
Insurance sector pagePublic Sector
CCS / G-Cloud framework, NCSC-aligned, citizen-facing services, PSN-compliance scrutiny.
Public sector pageWHY EJN LABS
What You Get From Vercel Security Review
Six concrete differentiators competitors don’t all match.
CREST-Certified Testers, Verifiable
Every test by a CREST-certified pen tester (CRT, CCT APP, CCT INF where applicable). Verify our company status at crest-approved.org.
24-Hour Startup, Where Required
From signed scope to active testing in a single business day for incident response, audit deadlines, or regulator-driven timelines.
Live Findings, Not 4-Week PDFs
Critical issues reported during testing through your client portal. Your team remediates while testing continues.
Audit-Ready Reports
Executive summary plus full technical report with CVSS scores and explicit framework mappings (ISO 27001, SOC 2, PCI DSS, FCA SYSC).
Free Retests, Standard
Verify remediation of every finding before close-out. Letter of attestation for audit submission included. Most competitors charge £1,500-£3,000 per retest.
UK-Based CREST Testers
Every engagement performed by vetted, UK-based CREST-certified testers, matched to your needs, security clearance, and compliance scope.
FAQ
Frequently Asked
Is this testing Vercel or testing us?
You. Vercel’s platform is out of scope and attacking it is not permitted. We pen test your project configuration, your functions, your middleware and your deployments, which is where findings actually occur.
Our preview deployments use the same environment variables as production. Is that a problem?
It is if the preview URL is reachable without signing in. Standard Protection covers all deployments except production domains, but a Deployment Protection setting of None leaves every preview public, along with whatever production data it can reach. We request each preview anonymously and from another team’s account, then check what the variables let us read. Vercel documents the protection scopes.
We use Next.js. Is that covered here or on the Next.js page?
Both, from different angles. The Next.js page covers the framework: middleware auth, server actions, SSRF, cache poisoning. This one covers the platform: previews, environment variables, deployment protection. Most clients scope them together.
Can you test our edge functions without our source?
We can black box them, and we will find less. Read access to the repository makes the function and middleware testing considerably more thorough, and we are happy to work under NDA.
We prefixed a key with NEXT_PUBLIC_ by mistake. Is it exposed?
Yes. Frameworks use that prefix to make a variable available to the browser, so the value is in the client bundle after the next build. Changing a variable only affects new deployments, so earlier deployments keep the old value. Rotate the key first, then we check current and earlier deployments for the old one.
20+ CREST-accredited testing services in one place
Web, mobile, API, cloud, AI, infrastructure, red team. Pick the test that fits your environment.
Get a fixed price for your Vercel deployment
Tell us how many projects and functions you run and whether preview deployments are in scope. Fixed-price quote from a named CREST assessor within one business day.
