Vercel
Security & compliance
Stability
Firewall enabled but no managed rulesets active
Part of the Deployment posture check · fix arrives as a guide
What it is
The Vercel Firewall is enabled but no managed rulesets are active.
Why it matters
The firewall is on and filtering nothing. The dashboard shows it enabled, which reads as protection, while common attack traffic passes straight through to your functions.
How to fix it
Enable the managed rulesets — the OWASP-style set at minimum — and review the logged matches before moving anything from log to block.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.