anyone know why aren't apps on vercel vulnerable? they are blocking that header?