Description

Ensure Vercel access tokens that have not been used for more than 90 days are deleted. Every team member should review the tokens on their Account Tokens page regularly and remove any that are no longer used by a script, CI pipeline, or integration.

Rationale

Unused tokens still give full access to everything their scope allows, often the whole account or team. They are easy to forget and may be stored in old scripts, laptops, or CI systems. If one leaks, an attacker can use it without anyone noticing. Removing unused tokens reduces the number of credentials that can be abused.

Impact

  • Removes forgotten credentials that could be abused

  • Reduces the attack surface of the account and team

  • Any tool still using a deleted token will stop working

Default Value

By default, tokens can be created without an expiration, and Vercel does not delete unused tokens automatically. Tokens are deactivated when the member who created them leaves the team.

Pre-Requisites

  • Access to your own Vercel account (tokens are managed per user)

  • A list of tools that use each token

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Open the Account Tokens page at https://vercel.com/account/tokens (make sure your personal account is selected in the scope selector).

  3. Review each token and check when it was last used.

  4. Alternatively, call the Vercel API GET /v6/user/tokens and check each token's activeAt date.

  5. If a token has not been used for more than 90 days, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Open the Account Tokens page at https://vercel.com/account/tokens (make sure your personal account is selected in the scope selector).

  3. For each unused token, confirm no tool depends on it.

  4. Delete the token.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Open the Account Tokens page at https://vercel.com/account/tokens (make sure your personal account is selected in the scope selector).

  3. Create a new token with the narrowest scope needed and an expiration date.

  4. Update the tool that needs it with the new token.

Reference