What does a Vercel security scanner check today?
It checks the domain in front of your app, not your Git repo. Certificate health, HTTPS behavior, security headers, DNS records, SPF and DMARC, cookie signals, and public exposure indicators.
Vercel makes deploys easy. That does not mean your public posture is automatically tight. Plenty of teams ship fast and only find out about weak headers or email spoofing risk when a customer asks.
RedScore runs a passive outside-in scan in about 60 seconds. No Vercel token, no repo upload, no invasive testing.
What is this not?
This is not a source-code audit. It is not an authenticated app test. It is not a review of your Vercel environment variables or project settings.
It is the first pass for what people can already check from the outside. That is usually enough to catch embarrassing public gaps before a demo or pilot.
How do I run a Vercel security scan?
- Deploy to a public hostname or custom domain.
- Go to /lookup and enter the production domain customers hit.
- Read the category grades and fix-first summary on the report.
- Fix the top failures.
- Rescan from /lookup after you ship fixes.
Book a pentest later if you need active testing. Start with the free outside-in scan first.