Vercel
Security & compliance
Releases
No deployment protection (password/SSO/trusted-IP all absent)
Part of the Deployment posture check · fix arrives as a guide
What it is
The project has no deployment protection: password protection, Vercel Authentication, and trusted IPs are all off.
Why it matters
Every deployment URL — preview, staging, and branch — is publicly reachable by anyone who finds it. Preview URLs turn up in link previews, crawler logs, and shared screenshots more often than teams expect.
How to fix it
Enable Vercel Authentication so previews require a team login, and keep production public deliberately rather than by default. Password protection is a reasonable fallback where SSO is not available.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.