Yes, if you have not closed it - and this one is worth checking today. It applies specifically to apps on Vercel behind Cloudflare.
Every Vercel deployment gets a public .vercel.app URL in addition to your custom domain. That second URL goes directly to Vercel, completely bypassing Cloudflare. So every protection you configured at the edge - WAF rate limiting, Browser Integrity Check, bot rules, security-level challenges - simply does not apply when someone uses it. They are talking to your app with no bouncer at the door. And the URL is not secret: it is in your dashboard, in deployment logs, and often guessable from the project name.
The trap most guides get wrong. On the free Hobby plan, Vercel's "Standard Protection" does not protect your production domain - it only covers preview and generated deployment URLs, and Vercel treats the short project-name.vercel.app as production, so it stays public. Covering production needs a paid plan. And deleting the alias does not stick, because Vercel re-assigns it on the next deploy. This was verified live in 2026: projects set to "Standard Protection" on Hobby were still serving the app on .vercel.app with Cloudflare fully bypassed.
The fix that works on every plan, for free: a one-time redirect in vercel.json - when the incoming Host is any *.vercel.app, 307-redirect every path to your real domain. It lives in your deployed config, so it travels with every deploy and survives re-assignment. Make it the first redirect (redirects are first-match-wins and run before your SPA rewrite), use a regex host so it catches the auto-generated URLs too, and use a 307 so it preserves POST bodies - meaning an API call aimed at the bypass host never executes there. Your real domain is untouched, because the rule only fires on a .vercel.app Host.
Two lessons worth carrying: the live bypass hostname is often not the obvious project-name.vercel.app but a generated one, so match with a regex rather than a literal. And audit every path that can reach your app without passing your CDN, not just the first one you noticed. Full item: https://www.tigzig.com/security/frontend.