Back to Checks
vercel

Vercel project has Git fork protection enabled to prevent untrusted forks from accessing secrets

project_git_fork_protection_enabled
Service: projectSeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedvercel-hobby-plan
Resource Type:NotDefined

Vercel projects are assessed for Git fork protection configuration, which controls whether pull requests from forked repositories can trigger deployments and access environment variables. When disabled, anyone who forks a public repository can submit a pull request that triggers a Vercel build with access to the project's environment variables, including secrets and API keys.

Prowler logoProwlerprowler-provider-vercel

Risk

Without Git fork protection, an attacker can fork a public repository, modify the build process to exfiltrate environment variables (API keys, database credentials, third-party tokens), and submit a pull request. The Vercel build triggered by the PR would execute the attacker's code with access to the project's secrets, leading to credential theft and potential full system compromise.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks project_git_fork_protection_enabled

Recommendation

Enable Git fork protection to require explicit authorization before pull requests from forked repositories can trigger deployments. This prevents untrusted contributors from accessing environment variables and secrets through the build process. For open-source projects, review fork PRs manually before allowing builds.

Remediation

Other

1Sign in to the Vercel dashboard
2Navigate to the project Settings > General
3Scroll to the 'Git Fork Protection' section
4Enable the option to require authorization for fork pull requests
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.services.project.project_client import project_client


class project_git_fork_protection_enabled(Check):
    """Check if Git fork protection is enabled for the project.

    This class verifies whether each Vercel project has Git fork protection
    enabled to prevent untrusted forks from accessing environment variables
    and triggering deployments.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel Project Git Fork Protection check.

        Iterates over all projects and checks if Git fork protection is enabled.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for project in project_client.projects.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=project)

            if project.git_fork_protection:
                report.status = "PASS"
                report.status_extended = (
                    f"Project {project.name} has Git fork protection enabled, "
                    f"preventing untrusted forks from accessing secrets."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.name} does not have Git fork protection "
                    f"enabled, allowing forks to access environment variables "
                    f"and trigger deployments."
                )

            findings.append(report)

        return findings

References