Back to Checks
vercel

Vercel project has password protection configured for deployments

project_password_protection_enabled
Service: projectSeverity: medium
OfficialBuilt-inVerified
Categories:internet-exposedvercel-pro-plan
Resource Type:NotDefined

Vercel projects are assessed for password protection configuration, which adds a shared-password gate in front of deployments requiring visitors to enter a password before they can access the application. This provides an additional layer of access control beyond Vercel Authentication, useful for sharing preview deployments with external stakeholders who do not have Vercel accounts.

Prowler logoProwlerprowler-provider-vercel

Risk

Without password protection, deployments are accessible to anyone who has the URL. For projects that contain pre-release features, client work, or sensitive content, this means unauthorized individuals can view and interact with the application without any authentication barrier.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks project_password_protection_enabled

Recommendation

Enable password protection to add a shared-password gate to your deployments. This is especially recommended for preview deployments shared with external clients or stakeholders who do not have Vercel accounts. Combine with Vercel Authentication for defense-in-depth.

Remediation

Other

1Sign in to the Vercel dashboard
2Navigate to the project Settings > General
3Scroll to the 'Password Protection' section
4Enable Password Protection and set a strong shared password
5Click Save
6Share the password only with authorized stakeholders

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.project.project_client import project_client


class project_password_protection_enabled(Check):
    """Check if password protection is enabled for the project.

    This class verifies whether each Vercel project has password protection
    configured to restrict access to deployments with a shared password.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel Project Password Protection check.

        Iterates over all projects and checks if password protection is configured.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for project in project_client.projects.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=project)

            if (
                project.password_protection
                and isinstance(project.password_protection, dict)
                and project.password_protection.get("deploymentType")
            ):
                report.status = "PASS"
                report.status_extended = (
                    f"Project {project.name} has password protection configured "
                    f"to restrict access to deployments."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.name} does not have password protection "
                    f"configured for deployments."
                    f"{plan_reason_suffix(project.billing_plan, {'hobby'}, 'password protection is not available on the Vercel Hobby plan.')}"
                )

            findings.append(report)

        return findings

References