Description
Ensure Git Fork Protection is enabled on every Git-connected Vercel project, so that pull requests opened from forks of the repository are not deployed automatically. A project owner or team member must review and approve the pull request before Vercel builds and deploys it.
Rationale
Anyone can fork a public repository and open a pull request. Without Git Fork Protection, Vercel would automatically build and deploy that untrusted code with access to the project's environment variables. An attacker could use this to steal secrets simply by opening a pull request. Requiring approval makes sure untrusted code is reviewed before it runs.
Impact
Fork pull requests are not deployed without approval
Protects environment variables from untrusted code
Adds a manual approval step for outside contributors
Default Value
By default, Git Fork Protection is enabled.
Pre-Requisites
Team Owner or Member role, or Project Administrator
A project connected to a Git repository
Test Plan
Sign in to Vercel at https://vercel.com.
Select your team from the team switcher.
Select the project from the dashboard.
Open Settings in the sidebar and select Security.
Verify that Git Fork Protection is enabled.
If it is disabled, follow the implementation steps.
Implementation Steps
Sign in to Vercel at https://vercel.com.
Select your team from the team switcher.
Select the project from the dashboard.
Open Settings in the sidebar and select Security.
Enable Git Fork Protection and save.
Backout Plan
Sign in to Vercel at https://vercel.com.
Select your team from the team switcher.
Select the project from the dashboard.
Open Settings in the sidebar and select Security.
Disable Git Fork Protection and save.
Reference