Back to Checks
vercel

Vercel project has deployment protection enabled on preview deployments

project_deployment_protection_enabled
Service: projectSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedvercel-hobby-plan
Resource Type:NotDefined

Vercel projects are assessed for deployment protection configuration, which restricts access to preview deployments by requiring authentication before visitors can view them. When disabled, anyone with the preview URL can access in-progress or staging versions of the application, potentially exposing unreleased features, debug information, or internal endpoints.

Prowler logoProwlerprowler-provider-vercel

Risk

Without deployment protection on preview deployments, any person who obtains or guesses a preview URL can view unreleased application code, test data, or internal API endpoints. This increases the attack surface and may leak sensitive business logic or credentials embedded in preview builds.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks project_deployment_protection_enabled

Recommendation

Enable deployment protection on preview deployments to require authentication before visitors can access preview URLs. Use 'Standard Protection' for Vercel Authentication or configure trusted IP ranges for more granular control.

Remediation

Other

1Sign in to the Vercel dashboard
2Navigate to the project Settings > General
3Scroll to Deployment Protection
4Under Preview deployments, select 'Standard Protection' or 'Vercel Authentication'
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.services.project.project_client import project_client


class project_deployment_protection_enabled(Check):
    """Check if deployment protection is enabled on preview deployments.

    This class verifies whether each Vercel project has deployment protection
    configured for preview deployments to prevent unauthorized access.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel Project Deployment Protection check.

        Iterates over all projects and checks if deployment protection is enabled
        on preview deployments.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for project in project_client.projects.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=project)

            if (
                project.deployment_protection is not None
                and project.deployment_protection.level != "none"
            ):
                report.status = "PASS"
                report.status_extended = (
                    f"Project {project.name} has deployment protection enabled "
                    f"with level '{project.deployment_protection.level}' on preview deployments."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.name} does not have deployment protection "
                    f"enabled on preview deployments."
                )

            findings.append(report)

        return findings

References