Skip to content

Vercel access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Vercel, Black Cat runs 13 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Vercel connector needs.

Checks (13)

severity: high SSO Not Enforced fix difficulty: medium #

Enable and enforce SAML SSO for all team members

  1. Navigate to https://vercel.com/<team>/settings/security
  2. Locate the "SAML Single Sign-On" section
  3. Click "Configure SAML" and enter your identity provider metadata
  4. Save the SAML configuration and verify the IdP connection
  5. Enable the "Enforce SAML SSO" toggle to require SSO for all members
  6. Notify team members to re-authenticate via SSO

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Auto Join Enabled fix difficulty: easy #

Remove the email domain auto-join setting to prevent automatic team membership

  1. Navigate to https://vercel.com/<team>/settings/members
  2. Locate the "Auto-Join" or "Email Domain" section
  3. Remove the configured email domain(s) from the auto-join allowlist
  4. Save the configuration
  5. Audit existing members to ensure no unauthorized accounts joined via auto-join

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive Owners fix difficulty: easy #

Reduce the number of team owners to the minimum required

  1. Navigate to https://vercel.com/<team>/settings/members
  2. Review the list of members with the "Owner" role
  3. Identify members who do not strictly require owner-level access
  4. Click the member's role dropdown and downgrade them to "Member" or another least-privilege role
  5. Retain only members who require owner access for administrative operations

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Non-SSO Member fix difficulty: medium #

Ensure all team members authenticate via SSO and remove non-SSO accounts

  1. Navigate to https://vercel.com/<team>/settings/members
  2. Identify members whose join origin is not SAML/SSO
  3. Remove those members from the team
  4. Re-invite the affected users through your identity provider so they join via SSO
  5. Verify all active members show SSO as their authentication method

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Overly Broad Access fix difficulty: medium #

Scope access groups to specific projects instead of all projects

  1. Navigate to https://vercel.com/<team>/settings/access-groups
  2. Select the access group that grants access to all projects
  3. Edit the group and assign it to only the specific projects that members need
  4. Remove the "all projects" or wildcard project assignment
  5. Save the configuration and notify affected members of the change

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Excessive Members fix difficulty: medium #

Split large access groups into smaller, more targeted groups

  1. Navigate to https://vercel.com/<team>/settings/access-groups
  2. Select the access group with a large number of members
  3. Review membership and identify distinct user groups or roles
  4. Create new, smaller access groups for each distinct group with appropriate project scopes
  5. Move members to the appropriate new groups and remove them from the oversized group
  6. Delete or repurpose the original large group if no longer needed

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Overprivileged Integration fix difficulty: medium #

Reduce the scopes granted to overprivileged integrations to least privilege

  1. Navigate to https://vercel.com/<team>/~/integrations
  2. Select the integration with excessive permission scopes
  3. Review the list of granted scopes and identify those not required for the integration's function
  4. If the integration supports scope reconfiguration, edit the integration and remove unnecessary scopes
  5. If scope reduction is not supported, remove the integration and reinstall it requesting only the minimum required scopes
  6. Verify the integration continues to function correctly with the reduced permissions

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Token No Expiration fix difficulty: medium #

Regenerate API tokens with an expiration date to limit the exposure window

  1. Navigate to https://vercel.com/account/tokens
  2. Identify the token(s) that have no expiration date
  3. Create a new token by clicking "Create Token", providing a name, and setting an appropriate expiration date
  4. Update all systems or CI pipelines using the old token with the newly created token value
  5. Delete the old non-expiring token by clicking the trash icon next to it
  6. Verify all dependent services continue to authenticate successfully

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Token Stale fix difficulty: easy #

Rotate stale API tokens that have not been used recently

  1. Navigate to https://vercel.com/account/tokens
  2. Review the "Last Used" date for each token and identify tokens not used within the expected period
  3. If the token is still needed, create a replacement token with an expiration date, update dependent systems, then delete the old token
  4. If the token is no longer needed, click the trash icon to delete it immediately
  5. Document token ownership and purpose to facilitate future rotation audits

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.c NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Token Overprivileged fix difficulty: medium #

Replace full-access tokens with scoped tokens granting only required permissions

  1. Navigate to https://vercel.com/account/tokens
  2. Identify tokens with full account access or broad scopes
  3. Click "Create Token" and select the minimum required scope for the token's intended use case
  4. Set an expiration date and save the new scoped token
  5. Update all systems or CI pipelines using the old broad-access token with the new scoped token value
  6. Delete the old overprivileged token by clicking the trash icon next to it

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Project No Deployment Protection fix difficulty: easy #

Enable SSO or password protection on project deployments to prevent unauthorized access

  1. Navigate to https://vercel.com/<team>/<project>/settings/deployment-protection
  2. Enable either SSO Protection or Password Protection for preview and production deployments
  3. For SSO Protection, select the deployment types to protect (preview, production, or both)
  4. For Password Protection, set a strong password and select protected deployment types
  5. Save the configuration and verify that deployments now require authentication

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Member Unconfirmed fix difficulty: easy #

Review and revoke unconfirmed team member invitations

  1. Navigate to https://vercel.com/<team>/settings/members
  2. Identify members with pending or unconfirmed invitation status
  3. Contact the invited member to confirm whether they still need access
  4. If no longer needed, revoke the invitation by removing the member
  5. If still needed, resend the invitation and set a deadline for confirmation

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: low Access Group Empty fix difficulty: easy #

Remove empty access groups that have no members

  1. Navigate to https://vercel.com/<team>/settings/access-groups
  2. Identify the access group with zero members
  3. Determine whether the group is still needed or was created in error
  4. If no longer needed, delete the empty access group
  5. If still needed, add the appropriate members to the group

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Vercel checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial