Vercel team has no invitations older than 30 days

​

What this check verifies

Vercel team is assessed for stale invitations by checking whether pending invitations have been outstanding for more than 30 days. Stale invitations may indicate abandoned onboarding processes or forgotten invitation links that could be exploited.

​

Risk

Stale pending invitations represent unresolved access grants. If invitation links are intercepted or forwarded to unintended recipients, they could be used to gain unauthorized access to the team. Old invitations also indicate poor access lifecycle management.

​

Recommendation

Regularly review and revoke stale team invitations. Establish a process to follow up on pending invitations within a reasonable timeframe and revoke those that are no longer needed to reduce the risk of unauthorized access.

​

Remediation

Dashboard steps

1. Navigate to your Vercel team settings
2. Go to the Members section
3. Review all pending invitations
4. Revoke any invitations that have been pending for more than 30 days
5. Re-invite members if still needed

​

References

• https://vercel.com/docs/accounts/team-members-and-roles

​

Where this check fires

This check runs on every scheduled scan against your Vercel account. Findings appear at Cloud Security → Findings filterable by Check ID = team_no_stale_invitations. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Vercel checks