Vercel production deployments have protection enabled

​

What this check verifies

Vercel projects are assessed for production deployment protection configuration, which restricts access to the live production deployment by requiring Vercel Authentication or other access controls. When enabled, visitors must authenticate before accessing the production URL, adding a layer of defense for internal applications or projects that should not be publicly accessible.

​

Risk

Without production deployment protection, the live production deployment is fully accessible to anyone on the internet. For internal tools, admin panels, or pre-launch applications this means unauthorized users can interact with production systems, potentially exploiting vulnerabilities, accessing sensitive data, or abusing application functionality.

​

Recommendation

Enable deployment protection on production deployments for applications that should not be publicly accessible. This is critical for internal tools, admin dashboards, and pre-launch applications where unauthorized access could lead to data exposure or system compromise.

​

Remediation

Dashboard steps

1. Sign in to the Vercel dashboard
2. Navigate to the project Settings > General
3. Scroll to Deployment Protection
4. Under Production deployments, select ‘Standard Protection’ or ‘Vercel Authentication’
5. Click Save

​

References

• https://vercel.com/docs/security/deployment-protection

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = project_production_deployment_protection_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks