Vercel stops stripping Server-Timing headers August 10

Vercel will stop stripping Server-Timing headers at its CDN edge on August 10, per the changelog.

That breaks the setup for any team that used Server-Timing as a private debug channel, trusting the CDN to keep it from reaching the browser. After the switch, backend metrics like database query time show up in browser devtools and RUM tooling instead of stopping at the edge.

Right now the CDN swallows the header before a response leaves Vercel's edge. Once the change ships, whatever a backend writes into Server-Timing rides along unchanged, with the changelog naming query time as the kind of value that gets through.

The changelog doesn't mention an opt-out. It gives a date and one instruction: audit what's in the header before it ships.

That audit is mechanical: pull every response that sets Server-Timing and check whether the values are safe for a stranger to see. Query time is the example in the changelog. Anything else with the same problem needs to come out too.