Vercel production deployments originate from a stable branch

​

What this check verifies

Vercel production deployments are assessed for source branch stability by verifying they are sourced from a stable branch (main or master). Deploying to production from feature branches bypasses standard CI/CD review processes and may introduce untested or incomplete code into the production environment.

​

Risk

Production deployments from feature branches may contain untested, incomplete, or unapproved code changes. This bypasses the standard code review and merge workflow, increasing the risk of shipping bugs, security vulnerabilities, or breaking changes to end users.

​

Recommendation

Configure the production branch to main or master and ensure all production deployments go through the standard merge workflow. Use branch protection rules in your Git provider to prevent direct pushes to the production branch.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to the project Settings > Git
3. Ensure the Production Branch is set to ‘main’ or ‘master’
4. Review recent production deployments and revert any that originated from feature branches

​

References

• https://vercel.com/docs/deployments/git

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = deployment_production_uses_stable_target. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks