Vercel project has Git fork protection enabled

​

What this check verifies

Vercel projects are assessed for Git fork protection configuration, which controls whether pull requests from forked repositories can trigger deployments and access environment variables. When disabled, anyone who forks a public repository can submit a pull request that triggers a Vercel build with access to the project’s environment variables, including secrets and API keys.

​

Risk

Without Git fork protection, an attacker can fork a public repository, modify the build process to exfiltrate environment variables (API keys, database credentials, third-party tokens), and submit a pull request. The Vercel build triggered by the PR would execute the attacker’s code with access to the project’s secrets, leading to credential theft and potential full system compromise.

​

Recommendation

Enable Git fork protection to require explicit authorization before pull requests from forked repositories can trigger deployments. This prevents untrusted contributors from accessing environment variables and secrets through the build process. For open-source projects, review fork PRs manually before allowing builds.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to the project Settings > General
3. Scroll to the ‘Git Fork Protection’ section
4. Enable the option to require authorization for fork pull requests
5. Click Save

​

References

• https://vercel.com/docs/security/deployment-protection/managing-deployment-protection#git-fork-protection

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = project_git_fork_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks