# Ensure Vercel production deployments originate from a stable branch

- Source: https://support.icompaas.com/support/solutions/articles/a_1790262008040339-ensure-vercel-production-deployments-originate-from-a-stable-branch
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the project's production branch is set to a stable, protected branch such as main, and that production deployments come only from that branch. The branch should have protection rules in the Git provider, such as required reviews, so changes cannot reach production without approval.

**Rationale**

If production is linked to a feature branch or an unprotected branch, untested or unreviewed code can go live immediately. Production deployments made directly from local machines also skip review. Using a stable, protected branch makes sure every production change has been reviewed and tested before users see it.

**Impact**

-   Only reviewed code reaches production
    
-   Reduces the risk of broken or malicious releases
    
-   Direct CLI production deploys should be limited
    

**Default Value**

By default, the production branch is the repository's default branch, often main. It can be changed in the project's Environments settings.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    
-   Admin access to the Git repository to set branch protection
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open Production.
    
5.  In the Branch Tracking section, verify that it shows Branch is followed by a stable branch such as main. The Environments list also shows this branch next to Production.
    
6.  Open Deployments, filter by Production, and verify that recent production deployments came from that branch.
    
7.  In your Git provider, verify that the branch has protection rules such as required reviews.
    
8.  If any of these fail, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings in the sidebar, select Environments, and open Production.
    
5.  In the Branch Tracking section, keep Branch is selected, enter your stable branch (for example, main), and select Save.
    
6.  In your Git provider, add branch protection rules that require pull request reviews for that branch.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Settings > Environments > Production and set Branch Tracking back to the previous branch.
    

**Reference**

-   [https://vercel.com/kb/guide/can-i-use-a-non-default-branch-for-production](https://vercel.com/kb/guide/can-i-use-a-non-default-branch-for-production)
    
-   [https://vercel.com/docs/deployments/production-env](https://vercel.com/docs/deployments/production-env)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.