Description
Ensure the Directory Listing setting is disabled for the project, so that a request for a folder that has no index file returns a 404 error instead of showing a list of all the files in that folder. This keeps the structure and contents of deployments hidden from visitors.
Rationale
When directory listing is enabled, visitors can browse the contents of any folder that does not have an index file. This can reveal file names, backups, configuration files, and other files that were never meant to be linked or found. Attackers can use this information to map the application and find sensitive files.
Impact
Hides the file structure of deployments
Reduces the risk of exposing unlinked files
Folders without an index file return 404
Default Value
By default, Directory Listing is disabled for projects created after January 12, 2021, and it was turned off for older projects in 2021.
Pre-Requisites
Team Owner or Member role, or Project Administrator
Test Plan
Sign in to Vercel at https://vercel.com.
Select your team from the team switcher.
Select the project from the dashboard.
Open Settings in the sidebar and select Advanced.
In the Directory Listing section, verify that the toggle shows Disabled.
If it is enabled, follow the implementation steps.
Implementation Steps
Sign in to Vercel at https://vercel.com.
Select your team from the team switcher.
Select the project from the dashboard.
Open Settings in the sidebar and select Advanced.
In the Directory Listing section, turn off the toggle so it shows Disabled, and select Save.
Backout Plan
Sign in to Vercel at https://vercel.com.
Select your team from the team switcher.
Select the project from the dashboard.
Open Settings in the sidebar and select Advanced.
In the Directory Listing section, turn on the toggle and select Save.
Reference