The 30 Vercel security checks Black Cat runs

Black Cat SSPM evaluates 30 security policies against your Vercel configuration on every scan, classifies each finding by risk, and provides remediation steps. Browse them by topic below.

How to connect Vercel — what access Black Cat needs, and why.

Access control & privilege (13)

SSO Not Enforced severity: high
Auto Join Enabled severity: medium
Excessive Owners severity: medium
Non-SSO Member severity: low
Overly Broad Access severity: medium
Excessive Members severity: low
Overprivileged Integration severity: high
Token No Expiration severity: high
Token Stale severity: medium
Token Overprivileged severity: high
Project No Deployment Protection severity: high
Member Unconfirmed severity: medium
Access Group Empty severity: low

Data sharing & exposure (6)

Sensitive Env Var Policy Disabled severity: medium
IP Visibility Enabled severity: low
Public Source severity: high
Directory Listing Enabled severity: medium
Plain Text Secret severity: high
Exposed to Preview severity: medium

Configuration hardening (9)

Deployment Protection Disabled severity: high
Strict Deployment Protection Disabled severity: medium
Fork Protection Disabled severity: medium
No Target Restriction severity: low
SSL Not Verified severity: high
Domain Expiring Soon severity: medium
Stale Integration severity: medium
Insecure Log Drain severity: medium
Auto Expose System Environment Variables severity: medium

Other checks (2)

severity: medium No Log Drain fix difficulty: medium #

Configure a log drain to forward logs to an external monitoring service

Navigate to https://vercel.com/<team>/settings/log-drains
Click "Add Log Drain"
Select the delivery format (JSON, NDJSON, or syslog) supported by your monitoring service
Enter the HTTPS endpoint URL of your log aggregation or SIEM platform
Select the log sources to forward (build, static, lambda, edge)
Save the configuration and verify logs are being received by the external service

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC7.2 CIS Controls v8 CIS-08 NIST CSF 2.0 DE.CM GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-312.b NIS2 Directive NIS2-21.b.2 DORA (SaaS Security) DORA-10.1

severity: high Log Drain Disabled fix difficulty: medium #

Re-enable or fix disabled log drains to restore log forwarding

Navigate to https://vercel.com/<team>/settings/log-drains
Locate the log drain that is not actively sending logs
Check the status and error details for the cause of the failure
If the destination endpoint is unreachable, verify the URL and ensure the server is running
Re-enable the log drain or delete and recreate it with a working endpoint
Verify logs are being received by the destination service