Back to Skills

vercel-deployment

Expert knowledge for deploying to Vercel with Next.js

44,376stars6,525forksUpdated 8/4/2026

Security Assessment

Safe(95/100)
Security Score95/100

About vercel-deployment

Vercel Deployment is a Claude Code reference skill capturing expert knowledge for deploying Next.js applications to Vercel. It solves the problem of getting production Vercel deployments right by consolidating configuration patterns and, importantly, the common mistakes that break deployments or leak secrets, so Claude can guide setup without repeating well-known pitfalls.

The skill documents environment-variable setup across Vercel's development, preview, and production environments, clearly distinguishing public NEXT_PUBLIC_ variables from server-only secrets. It explains choosing between Edge and Serverless runtimes for API routes and middleware, build optimization in next.config.js (standalone output, image remote patterns, bundle analysis, dynamic imports), the preview-deployment workflow with per-PR URLs and deployment protection, and custom-domain setup with DNS records and redirects. A prominent Sharp Edges section flags security-critical hazards: using NEXT_PUBLIC_ for sensitive keys (which inlines them into the browser bundle where anyone can read them), preview deployments accidentally using the production database, and oversized serverless functions causing slow cold starts, each with symptoms, root cause, and a recommended fix.

It targets Next.js developers and teams deploying to Vercel who want production-ready configuration and to avoid secret exposure and environment cross-contamination. This is a security-conscious documentation reference rather than an automation tool: much of its value is defensive guidance about keeping service-role keys, secret keys, database URLs, and JWT secrets out of client bundles and separating preview from production data. It lists nextjs-app-router as a prerequisite skill.

FAQ

What is the main hazard it warns about with environment variables?

Using the NEXT_PUBLIC_ prefix for sensitive keys. Those variables are inlined into the JavaScript bundle at build time and visible to anyone in browser DevTools, so service-role keys, secret keys, database URLs, and JWT secrets must never use that prefix.

When should I use Edge versus Serverless runtime?

Edge runtime has fast cold starts but limited APIs and suits auth checks, redirects, and simple transforms (middleware is always edge). Serverless (Node.js) offers full Node APIs at the cost of slower cold starts and suits database queries, file operations, and heavy computation.

How should preview deployments handle databases?

Configure separate databases per environment. The skill warns that preview deployments run untested code, so pointing them at the production database risks corrupting or polluting production data. It suggests staging databases or branch databases from providers like Neon, PlanetScale, or Supabase.

Are there prerequisites?

The skill lists nextjs-app-router as a required companion skill, since the guidance is specific to deploying Next.js App Router applications to Vercel.

What does it recommend for serverless function size?

It notes Vercel serverless functions have a compressed size limit and that large functions cause slow cold starts, recommending dynamic imports for heavy libraries and bundle analysis to keep function size down.

Install vercel-deployment

Download and extract the skill files to your .claude/skills/ directory.

Quick Setup:

  1. Copy the skill folder to .claude/skills/
  2. Claude will automatically detect and use the skill