Vercel
Releases
Stability
Security & compliance
Code quality
Performance
Deployment posture
Access control, function defaults, and how recent deploys went.
Overview
Reads your Vercel project’s protection settings, function configuration, and recent deployment history — including OOM crashes, error rates, and whether anything gated the last promotion to production.
What it looks for
- No deployment protection — password, SSO, and trusted IP all absent
- gitForkProtection disabled, exposing env vars and OIDC tokens to fork builds
- OOM crashes and elevated error rates in recent production deployments
- Promotions to production with no gate, or with a blocking check that failed
- Single-region function defaults against a cross-region database, short maxDuration with active crons
- OIDC issuer in global mode, firewall enabled with no managed ruleset active
Why it matters
Deployment protection left off means every environment you have is on the public internet. gitForkProtection off hands your environment variables and OIDC token to any forked pull request that opens a build.
Rules in this check
How the fixes arrive
GuideChanges only you can make safely arrive as a step-by-step guide you can follow yourself or hand to your coding agent.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.