Vercel project has password protection for deployments

​

What this check verifies

Vercel projects are assessed for password protection configuration, which adds a shared-password gate in front of deployments requiring visitors to enter a password before they can access the application. This provides an additional layer of access control beyond Vercel Authentication, useful for sharing preview deployments with external stakeholders who do not have Vercel accounts.

​

Risk

Without password protection, deployments are accessible to anyone who has the URL. For projects that contain pre-release features, client work, or sensitive content, this means unauthorized individuals can view and interact with the application without any authentication barrier.

​

Recommendation

Enable password protection to add a shared-password gate to your deployments. This is especially recommended for preview deployments shared with external clients or stakeholders who do not have Vercel accounts. Combine with Vercel Authentication for defense-in-depth.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to the project Settings > General
3. Scroll to the ‘Password Protection’ section
4. Enable Password Protection and set a strong shared password
5. Click Save
6. Share the password only with authorized stakeholders

​

References

• https://vercel.com/docs/security/deployment-protection/methods-to-protect-deployments/password-protection

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = project_password_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks