--- title: Securing Vercel at Scale: From One Team to Every Team description: Orca Security has added a read-only integration for Vercel Enterprise that gives security teams visibility across every team's settings in one place. It... canonical: https://daily.dev/posts/securing-vercel-at-scale-from-one-team-to-every-team-n2q0ptsow twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Securing Vercel at Scale: From One Team to Every Team | daily.dev og:description: Orca Security has added a read-only integration for Vercel Enterprise that gives security teams visibility across every team's settings in one place. It... og:url: https://daily.dev/posts/securing-vercel-at-scale-from-one-team-to-every-team-n2q0ptsow og:image: https://api.daily.dev/og/posts/n2Q0PtsOw.png og:image:alt: Securing Vercel at Scale: From One Team to Every Team og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Securing Vercel at Scale: From One Team to Every Team **[Orca Security Blog](https://daily.dev/sources/orca-security-blog)** · 7 min read · 0 upvotes · 0 comments ## Summary Orca Security has added a read-only integration for Vercel Enterprise that gives security teams visibility across every team's settings in one place. It inventories projects, deployments, domains, members, tokens, firewall rules and environment-variable metadata without reading secret values. Orca flags issues Vercel's own per-team Security Dashboard misses, like SAML configured but not enforced, pending invitations over 14 days, and access tokens unused for 90+ days. It also catches common AI-built-app mistakes such as production URLs left without login and secrets saved as readable 'Config' variables instead of write-only 'Secret' type. Findings land in the same queue as AWS, Azure and GCP results, alongside Claude Enterprise coverage in the same platform. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What's the difference between Config and Secret environment variable types in Vercel? Config variables are readable to anyone with project access, while Secret variables are write-only. Vercel introduced this distinction in August 2026 so values are encrypted at rest either way, but a variable like STRIPE_SECRET_KEY saved as Config type stays visible to project members, which is a common misconfiguration in AI-built apps. _Track environment-variable security practices like this on daily.dev as your team scales Vercel usage._ ### Does Vercel protect production deployments with authentication by default? No, Vercel's Deployment Protection covers preview URLs by default, but production deployments are a separate setting that builders often leave open since the app still works without it. Since September 2026, every Vercel plan can enable Vercel Authentication in front of production deployments for free and set it as the team default. _Developers hardening deployment pipelines can follow Vercel changes like this on daily.dev._ ### How many users does Vercel's v0 AI app builder have? Vercel's v0 has crossed 4 million users according to SaaStr, and Vercel CEO Guillermo Rauch has said more than 60% of activity on Vercel is now driven by coding agents rather than manual development, reflecting how much AI-generated app deployment now runs through the platform. _Keep up with shifts in AI-driven app deployment platforms like Vercel on daily.dev._ ## Similar posts on daily.dev - [Security for the Way You Work: Orca Integrates with Claude’s Compliance API](https://daily.dev/posts/security-for-the-way-you-work-orca-integrates-with-claude-s-compliance-api-nwydqwalj) · Orca Security Blog · 0 upvotes · 0 comments - [Introducing deepsec: The security harness for finding vulnerabilities in your codebase](https://daily.dev/posts/introducing-deepsec-the-security-harness-for-finding-vulnerabilities-in-your-codebase-midrxhthx) · Vercel · 4 upvotes · 0 comments - [Introducing AI AppGen Security to Protect the New Generation of AI Builders](https://daily.dev/posts/introducing-ai-appgen-security-to-protect-the-new-generation-of-ai-builders-p486ilgm2) · Orca Security Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#vibe-coding](https://daily.dev/tags/vibe-coding), [#vercel](https://daily.dev/tags/vercel), [#secrets-management](https://daily.dev/tags/secrets-management), [#cnapp](https://daily.dev/tags/cnapp) [View this post on daily.dev](https://daily.dev/posts/securing-vercel-at-scale-from-one-team-to-every-team-n2q0ptsow) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Securing Vercel at Scale: From One Team to Every Team","url":"https://daily.dev/posts/securing-vercel-at-scale-from-one-team-to-every-team-n2q0ptsow","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/securing-vercel-at-scale-from-one-team-to-every-team-n2q0ptsow"},"datePublished":"2026-10-27T16:48:29.077Z","dateModified":"2026-10-27T16:54:19.342Z","description":"Orca Security has added a read-only integration for Vercel Enterprise that gives security teams visibility across every team's settings in one place. It...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8951609f9c5ebfd8c49fb49befef18c6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8951609f9c5ebfd8c49fb49befef18c6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Orca Security Blog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Orca Security Blog","logo":"https://media.daily.dev/image/upload/s--kkQFNboJ--/f_auto,q_auto/v1780213281/logos/orca-security-blog?_a=BAMAMiWQ0","url":"https://daily.dev/sources/orca-security-blog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/securing-vercel-at-scale-from-one-team-to-every-team-n2q0ptsow","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,vibe-coding,vercel,secrets-management,cnapp","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Orca Security Blog","item":"https://daily.dev/sources/orca-security-blog"},{"@type":"ListItem","position":3,"name":"Securing Vercel at Scale: From One Team to Every Team"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/securing-vercel-at-scale-from-one-team-to-every-team-n2q0ptsow#faq","mainEntity":[{"@type":"Question","name":"What's the difference between Config and Secret environment variable types in Vercel?","acceptedAnswer":{"@type":"Answer","text":"Config variables are readable to anyone with project access, while Secret variables are write-only. Vercel introduced this distinction in August 2026 so values are encrypted at rest either way, but a variable like STRIPE_SECRET_KEY saved as Config type stays visible to project members, which is a common misconfiguration in AI-built apps. Track environment-variable security practices like this on daily.dev as your team scales Vercel usage."}},{"@type":"Question","name":"Does Vercel protect production deployments with authentication by default?","acceptedAnswer":{"@type":"Answer","text":"No, Vercel's Deployment Protection covers preview URLs by default, but production deployments are a separate setting that builders often leave open since the app still works without it. Since September 2026, every Vercel plan can enable Vercel Authentication in front of production deployments for free and set it as the team default. Developers hardening deployment pipelines can follow Vercel changes like this on daily.dev."}},{"@type":"Question","name":"How many users does Vercel's v0 AI app builder have?","acceptedAnswer":{"@type":"Answer","text":"Vercel's v0 has crossed 4 million users according to SaaStr, and Vercel CEO Guillermo Rauch has said more than 60% of activity on Vercel is now driven by coding agents rather than manual development, reflecting how much AI-generated app deployment now runs through the platform. Keep up with shifts in AI-driven app deployment platforms like Vercel on daily.dev."}}]} ```