Vercel 43 rules 6 checks

Vercel deployment checks

Env vars that stay server-side, previews that do not leak staging data, functions that cache instead of burn. These are the rules lumioguard runs against a connected Vercel project.

Vercel 8 rules

Account supply chain

Integrations, owners, and domains on your Vercel team.

Security & complianceReleasesCode quality Open
Vercel 7 rules

Caching & cost

Where Vercel bills you for work it could have cached.

CostPerformanceStability Open
Vercel 12 rules

Deployment posture

Access control, function defaults, and how recent deploys went.

ReleasesStabilitySecurity & compliance Open
Vercel 5 rules

Edge runtime readiness

Code on the edge runtime that does not belong there.

ReleasesPerformanceCost Open
Vercel 6 rules

Preview deploy safety

Preview URLs are public until you make them otherwise.

Security & complianceReleasesCode quality Open
Vercel 5 rules

Public env exposure

Secrets inlined into the browser bundle at build time.

Security & complianceReleasesCode quality Open

Every Vercel rule

Account supply chain

8 rules
Over-permissioned or team-wide integration VercelAccount supply chain Suspended/disabled integration still installed VercelAccount supply chain Non-marketplace integration with multiple scopes VercelAccount supply chain Excessive OWNER count VercelAccount supply chain Large number of pending invites VercelAccount supply chain Domain not verified with Vercel VercelAccount supply chain Domain DNS misconfiguration detected by Vercel VercelAccount supply chain Log drain pointing at an unrecognized third-party host VercelAccount supply chain

Caching & cost

7 rules
force-dynamic on non-personalized route VercelCaching & cost Missing revalidate / cache option on public data fetch VercelCaching & cost maxDuration > 60 s on non-streaming function VercelCaching & cost Image optimizer disabled (unoptimized: true) VercelCaching & cost Overly broad image remotePatterns wildcard VercelCaching & cost Unbounded collection response without pagination or streaming VercelCaching & cost Heavy bundle dependency in serverless route VercelCaching & cost

Deployment posture

12 rules
No deployment protection (password/SSO/trusted-IP all absent) VercelDeployment posture gitForkProtection: false — forked PRs get env vars + OIDC token VercelDeployment posture Single-region function defaults with a cross-region database VercelDeployment posture Short maxDuration with active crons VercelDeployment posture OOM crashes in recent production deployments VercelDeployment posture High ERROR-state deployment rate VercelDeployment posture No production deployments recorded VercelDeployment posture Runtime 5xx / error-level failures on the latest production deployment VercelDeployment posture No promotion-gate checks before production, or a blocking check failed yet promoted VercelDeployment posture OIDC issuer in global mode (tokens honored beyond this team) VercelDeployment posture Production deployments shipping with failing checks VercelDeployment posture Firewall enabled but no managed rulesets active VercelDeployment posture

Edge runtime readiness

5 rules
Node-only API in edge runtime VercelEdge runtime readiness Node-incompatible or oversized dependency in edge runtime VercelEdge runtime readiness Heavy DB/network work in middleware.ts VercelEdge runtime readiness Middleware missing config.matcher (runs on all routes) VercelEdge runtime readiness Edge data-fetch route missing preferredRegion VercelEdge runtime readiness

Preview deploy safety

6 rules
Preview deployments publicly accessible with staging data signals VercelPreview deploy safety Production/live secret found in preview env scope config VercelPreview deploy safety productionBrowserSourceMaps: true VercelPreview deploy safety Source maps enabled without environment guard in bundler config VercelPreview deploy safety No robots noindex for preview environments VercelPreview deploy safety Debug/verbose logging without production guard VercelPreview deploy safety

Public env exposure

5 rules
Live Stripe secret key exposed via NEXT_PUBLIC_ prefix VercelPublic env exposure Secret-named value behind a client-bundle prefix VercelPublic env exposure Ambiguous key or credential name behind a client-bundle prefix VercelPublic env exposure System env vars auto-exposed to every build (autoExposeSystemEnvs) VercelPublic env exposure Production secret env var older than a year (rotation hygiene) VercelPublic env exposure

Run them all on your app

Connect your repo and your live services with read-only scopes. The first scan is free, and nothing changes without your approval.

Start for Free View pricing