Description

Ensure the project has Deployment Protection turned on with Vercel Authentication, using Standard Protection or All Deployments, so that preview deployments and generated deployment URLs can only be opened by logged-in Vercel users who have access to the project.

Rationale

Preview deployments are built from branches and pull requests and often contain unreleased features, test data, debug output, and connections to non-production systems. Without protection, anyone who finds or guesses a preview URL can open it. Protecting previews keeps unfinished work private and reduces the chance of leaking sensitive information.

Impact

  • Preview URLs require a Vercel login

  • Prevents public access to unreleased work

  • Code that fetches VERCEL_URL may need updating

Default Value

By default, new projects use Vercel Authentication with Standard Protection, which protects preview deployments. Protection can be turned off per project.

Pre-Requisites

  • Team Owner or Member role, or Project Administrator

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).

  5. Verify that Vercel Authentication is enabled.

  6. Verify that Standard Protection or All Deployments is selected, not a Legacy option.

  7. Open a preview URL in a private browser window and confirm the Vercel login page appears.

  8. If previews are not protected, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).

  5. Enable Vercel Authentication.

  6. Select Standard Protection or All Deployments.

  7. Select Save.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).

  5. Select the previous option, or disable Vercel Authentication.

  6. Select Save.

Reference