Check ID: project_deployment_protection_enabled
Provider: Vercel
Service: project
Severity: HIGH
Categories: internet-exposed
Resource type: NotDefined

​
What this check verifies

Vercel projects are assessed for deployment protection configuration, which restricts access to preview deployments by requiring authentication before visitors can view them. When disabled, anyone with the preview URL can access in-progress or staging versions of the application, potentially exposing unreleased features, debug information, or internal endpoints.

​
Risk

Without deployment protection on preview deployments, any person who obtains or guesses a preview URL can view unreleased application code, test data, or internal API endpoints. This increases the attack surface and may leak sensitive business logic or credentials embedded in preview builds.

​
Recommendation

Enable deployment protection on preview deployments to require authentication before visitors can access preview URLs. Use ‘Standard Protection’ for Vercel Authentication or configure trusted IP ranges for more granular control.

​
Remediation

Dashboard steps
  1. Sign in to the Vercel dashboard
  2. Navigate to the project Settings > General
  3. Scroll to Deployment Protection
  4. Under Preview deployments, select ‘Standard Protection’ or ‘Vercel Authentication’
  5. Click Save

​
References

​
Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = project_deployment_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Vercel checks