Skip to content

Vercel configuration hardening security checks

Vendor-recommended secure defaults, patch levels and housekeeping settings that drift as tenants grow and admins change.

On Vercel, Black Cat runs 9 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Vercel connector needs.

Checks (9)

severity: high Deployment Protection Disabled fix difficulty: medium #

Enable deployment protection to restrict access to preview deployments

  1. Navigate to https://vercel.com/<team>/settings/security
  2. Locate the "Deployment Protection" section
  3. Enable either "SSO Protection" to require SSO authentication or "Password Protection" to set a shared password
  4. Configure the protection method with the required credentials or IdP settings
  5. Save the configuration and verify preview deployments prompt for authentication

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Strict Deployment Protection Disabled fix difficulty: easy #

Enable strict deployment protection to cover all deployment types

  1. Navigate to https://vercel.com/<team>/settings/security
  2. Locate the "Deployment Protection" section
  3. Enable "Strict Deployment Protection" to apply protection to all deployment types including preview and branch deployments
  4. Save the configuration
  5. Verify that all deployment URLs prompt for authentication

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Fork Protection Disabled fix difficulty: easy #

Enable git fork protection to prevent unauthorized deployments from forks

  1. Navigate to https://vercel.com/<team>/<project>/settings/git
  2. Locate the "Fork Protection" section
  3. Enable the "Protect from fork deployments" toggle
  4. Save the settings
  5. Verify that pull requests from forked repositories no longer trigger automatic deployments

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: low No Target Restriction fix difficulty: easy #

Restrict environment variables to only the environments where they are needed

  1. Navigate to https://vercel.com/<team>/<project>/settings/environment-variables
  2. Locate the environment variable targeting all environments (production, preview, development)
  3. Edit the variable and deselect any environments where it is not required
  4. For production secrets, select only "Production" as the target environment
  5. Save the changes and redeploy to apply the updated scope

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: high SSL Not Verified fix difficulty: medium #

Verify domain ownership so Vercel can issue a valid SSL certificate

  1. Navigate to https://vercel.com/<team>/settings/domains
  2. Locate the domain showing an unverified or SSL error status
  3. Follow the DNS configuration instructions shown by Vercel (CNAME or A record)
  4. Update the records at your domain registrar or DNS provider
  5. Wait for DNS propagation (up to 48 hours) and return to verify the domain status
  6. Confirm the SSL certificate is issued and the domain shows as verified

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.1f.i HIPAA (SaaS Security) HIPAA-312.e NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Domain Expiring Soon fix difficulty: easy #

Renew the expiring domain to prevent service disruption

  1. Navigate to https://vercel.com/<team>/settings/domains
  2. Identify the domain flagged as expiring soon
  3. If the domain is managed by Vercel, click "Renew" in the domain settings
  4. If the domain is managed externally, log in to your domain registrar and initiate renewal
  5. Enable auto-renewal at your registrar to prevent future expirations
  6. Confirm the expiration date has been extended after renewal completes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-25.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Stale Integration fix difficulty: easy #

Review and remove or update integrations that have not been updated recently

  1. Navigate to https://vercel.com/<team>/~/integrations
  2. Review installed integrations and identify those that have not been updated or used recently
  3. For integrations still in use, check the integration vendor for updates and reconfigure if needed
  4. For integrations no longer required, click "Remove" or "Uninstall" to revoke the integration
  5. Confirm removal and review any projects that were connected to the removed integration

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Insecure Log Drain fix difficulty: easy #

Update log drain endpoints to use HTTPS to encrypt log data in transit

  1. Navigate to https://vercel.com/<team>/settings/log-drains
  2. Locate the log drain using an HTTP (non-HTTPS) destination URL
  3. Click the log drain to edit it
  4. Update the destination URL to use the HTTPS scheme (e.g., change http:// to https://)
  5. Ensure the destination server has a valid SSL certificate
  6. Save the configuration and verify logs are being received over the secure connection

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.9 SOC 2 Type II CC6.1 CIS Controls v8 CIS-04.1 NIST CSF 2.0 PR.IP GDPR (SaaS Security) GDPR-5.2 HIPAA (SaaS Security) HIPAA-308.a1 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

severity: medium Auto Expose System Environment Variables fix difficulty: easy #

Disable automatic exposure of system environment variables to reduce information leakage

  1. Navigate to https://vercel.com/<team>/<project>/settings
  2. Scroll to the Environment Variables section
  3. Disable the "Automatically expose System Environment Variables" toggle
  4. Manually add only the system variables your build process requires
  5. Redeploy the project to apply the change

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.e.4 DORA (SaaS Security) DORA-9.10

More Vercel checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial