Back to Checks
vercel

Vercel project has deployment protection enabled on production deployments

project_production_deployment_protection_enabled
Service: projectSeverity: critical
OfficialBuilt-inVerified
Categories:internet-exposedvercel-pro-plan
Resource Type:NotDefined

Vercel projects are assessed for production deployment protection configuration, which restricts access to the live production deployment by requiring Vercel Authentication or other access controls. When enabled, visitors must authenticate before accessing the production URL, adding a layer of defense for internal applications or projects that should not be publicly accessible.

Prowler logoProwlerprowler-provider-vercel

Risk

Without production deployment protection, the live production deployment is fully accessible to anyone on the internet. For internal tools, admin panels, or pre-launch applications this means unauthorized users can interact with production systems, potentially exploiting vulnerabilities, accessing sensitive data, or abusing application functionality.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks project_production_deployment_protection_enabled

Recommendation

Enable deployment protection on production deployments for applications that should not be publicly accessible. This is critical for internal tools, admin dashboards, and pre-launch applications where unauthorized access could lead to data exposure or system compromise.

Remediation

Other

1Sign in to the Vercel dashboard
2Navigate to the project Settings > General
3Scroll to Deployment Protection
4Under Production deployments, select 'Standard Protection' or 'Vercel Authentication'
5Click Save

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.project.project_client import project_client


class project_production_deployment_protection_enabled(Check):
    """Check if deployment protection is enabled on production deployments.

    This class verifies whether each Vercel project has deployment protection
    configured for production deployments to prevent unauthorized public access.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel Project Production Deployment Protection check.

        Iterates over all projects and checks if deployment protection is enabled
        on production deployments.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for project in project_client.projects.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=project)

            if (
                project.production_deployment_protection is not None
                and project.production_deployment_protection.level != "none"
            ):
                report.status = "PASS"
                report.status_extended = (
                    f"Project {project.name} has production deployment protection "
                    f"enabled with level '{project.production_deployment_protection.level}'."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {project.name} does not have deployment protection "
                    f"enabled on production deployments."
                    f"{plan_reason_suffix(project.billing_plan, {'hobby'}, 'protecting production deployments is not available on the Vercel Hobby plan.')}"
                )

            findings.append(report)

        return findings

References