Vercel
Security & compliance
Non-marketplace integration with multiple scopes
Part of the Account supply chain check · fix arrives as a guide
What it is
A non-marketplace integration — one added directly rather than through Vercel's reviewed listings — holds multiple permission scopes.
Why it matters
Marketplace integrations go through a review; directly-added ones do not. Multiple scopes on an unreviewed integration means broad access to something nobody has vetted.
How to fix it
Confirm what the integration is and who added it, then reduce it to the minimum scopes it needs. Remove it if nobody can account for why it is there.
Run them all on your app
Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.