Vercel
Releases
Security & compliance
gitForkProtection: false — forked PRs get env vars + OIDC token
Part of the Deployment posture check · fix arrives as a guide
What it is
gitForkProtection is disabled on the project.
Why it matters
With it off, a build from a forked pull request runs automatically with your environment variables and an OIDC token. Anyone who can open a pull request can add a build step that prints them.
How to fix it
Re-enable fork protection in the project's Git settings. It requires a team member to authorize a deployment from a fork before it builds — so treat that authorization as granting the fork access to your build secrets, and read the diff first. Rotate anything that may have been exposed while it was off.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.