Vercel project has skew protection enabled to prevent version mismatches during deployments
Vercel projects are assessed for skew protection, which ensures clients always communicate with the correct deployment version during rollouts. Without it, clients may fetch assets or call APIs against a different version than the one that served the initial page, causing hydration errors or broken functionality.
ProwlerRisk
Without skew protection, users may experience version mismatches during deployment rollouts where the HTML is served from one deployment version but subsequent client-side navigation or API calls hit a newer version. This can cause broken user interfaces, failed client-side transitions, or data corruption from incompatible API contract changes.
Run this check with Prowler
Run in Prowler Cloudprowler vercel --checks project_skew_protection_enabledRecommendation
Enable skew protection to ensure that all client requests during a deployment rollout are routed to the same deployment version that served the initial page. This prevents version mismatch errors and ensures a consistent user experience during deployments.
Remediation
Other
Check Code
from typing import List
from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.project.project_client import project_client
class project_skew_protection_enabled(Check):
"""Check if skew protection is enabled for the project.
This class verifies whether each Vercel project has skew protection enabled
to ensure clients are served consistent deployment versions during rollouts.
"""
def execute(self) -> List[CheckReportVercel]:
"""Execute the Vercel Project Skew Protection check.
Iterates over all projects and checks if skew protection is enabled.
Returns:
List[CheckReportVercel]: A list of reports for each project.
"""
findings = []
for project in project_client.projects.values():
report = CheckReportVercel(metadata=self.metadata(), resource=project)
if project.skew_protection:
report.status = "PASS"
report.status_extended = (
f"Project {project.name} has skew protection enabled, "
f"ensuring consistent deployment versions during rollouts."
)
else:
report.status = "FAIL"
report.status_extended = (
f"Project {project.name} does not have skew protection enabled, "
f"which may cause version mismatches during deployments."
f"{plan_reason_suffix(project.billing_plan, {'hobby'}, 'skew protection is not available on the Vercel Hobby plan.')}"
)
findings.append(report)
return findings