Back to Checks
vercel

Vercel project has managed WAF rulesets enabled

security_managed_rulesets_enabled
Service: securitySeverity: high
OfficialBuilt-inVerified
Categories:internet-exposedvercel-hobby-plan
Resource Type:NotDefined

Vercel projects are assessed for managed WAF ruleset enablement. Managed rulesets are curated by Vercel and provide protection against known attack patterns including OWASP Top 10 threats. Availability varies by ruleset, and the check reports MANUAL when the firewall configuration cannot be assessed from the API.

Prowler logoProwlerprowler-provider-vercel

Risk

Without managed rulesets enabled, the firewall lacks curated protection rules against well-known attack patterns. The application relies solely on custom rules, which may miss new or evolving threats that managed rulesets are designed to detect and block automatically.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler vercel --checks security_managed_rulesets_enabled

Recommendation

Enable the managed WAF rulesets that are available for your Vercel plan to benefit from curated protection against common attack patterns. If the API does not expose firewall configuration for the project, verify the rulesets manually in the dashboard.

Remediation

Other

1Sign in to the Vercel dashboard
2Navigate to the project Settings > Security > Firewall
3Enable the managed rulesets that are available for your plan
4Review and configure ruleset sensitivity levels
5If the API does not expose firewall configuration for the project, verify the rulesets manually in the dashboard

Check Code

from typing import List

from prowler.lib.check.models import Check, CheckReportVercel
from prowler.providers.vercel.lib.billing import plan_reason_suffix
from prowler.providers.vercel.services.security.security_client import security_client


class security_managed_rulesets_enabled(Check):
    """Check if managed WAF rulesets are enabled for each project.

    This class verifies whether each Vercel project has managed rulesets
    enabled. Managed rulesets provide curated protection rules maintained
    by Vercel against known attack patterns. This feature is plan-gated
    and may not be available on all plans.
    """

    def execute(self) -> List[CheckReportVercel]:
        """Execute the Vercel Managed Rulesets Enabled check.

        Iterates over all firewall configurations and checks if managed
        rulesets are enabled. Reports MANUAL status when the firewall
        configuration cannot be assessed from the API.

        Returns:
            List[CheckReportVercel]: A list of reports for each project.
        """
        findings = []
        for config in security_client.firewall_configs.values():
            report = CheckReportVercel(metadata=self.metadata(), resource=config)

            if not config.firewall_config_accessible:
                report.status = "MANUAL"
                report.status_extended = (
                    f"Project {config.project_name} ({config.project_id}) "
                    f"could not be assessed for managed rulesets because the "
                    f"firewall configuration endpoint was not accessible. "
                    f"Manual verification is required."
                    f"{plan_reason_suffix(config.billing_plan, {'hobby', 'pro'}, 'some managed WAF rulesets, including the OWASP Core Ruleset, are only available on Vercel Enterprise plans.')}"
                )
            elif config.managed_rulesets:
                report.status = "PASS"
                report.status_extended = (
                    f"Project {config.project_name} ({config.project_id}) "
                    f"has managed WAF rulesets enabled."
                )
            else:
                report.status = "FAIL"
                report.status_extended = (
                    f"Project {config.project_name} ({config.project_id}) "
                    f"does not have managed WAF rulesets enabled."
                )

            findings.append(report)

        return findings

References