vercel nextjs security issue