# Ensure Vercel project has Git fork protection enabled to prevent untrusted forks from accessing secrets

- Source: https://support.icompaas.com/support/solutions/articles/a_1790262001030719-ensure-vercel-project-has-git-fork-protection-enabled-to-prevent-untrusted-forks-from-accessing-secrets
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Git Fork Protection is enabled on every Git-connected Vercel project, so that pull requests opened from forks of the repository are not deployed automatically. A project owner or team member must review and approve the pull request before Vercel builds and deploys it.

**Rationale**

Anyone can fork a public repository and open a pull request. Without Git Fork Protection, Vercel would automatically build and deploy that untrusted code with access to the project's environment variables. An attacker could use this to steal secrets simply by opening a pull request. Requiring approval makes sure untrusted code is reviewed before it runs.

**Impact**

-   Fork pull requests are not deployed without approval
    
-   Protects environment variables from untrusted code
    
-   Adds a manual approval step for outside contributors
    

**Default Value**

By default, Git Fork Protection is enabled.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    
-   A project connected to a Git repository
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar and select Security.
    
5.  Verify that Git Fork Protection is enabled.
    
6.  If it is disabled, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar and select Security.
    
5.  Enable Git Fork Protection and save.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar and select Security.
    
5.  Disable Git Fork Protection and save.
    

**Reference**

-   [https://vercel.com/docs/project-configuration/security-settings](https://vercel.com/docs/project-configuration/security-settings)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.