TechPrufer
Get started
Vercel
Vercel logoVercel · Feature trail

Deployment Protection

3 posts · Dec 2022 – Sep 2026

What this trail covers

Vercel's platform offers flexible deployment protection options, including Vercel Authentication for team collaboration, Shareable Links for external collaborators without Vercel accounts, and Advanced Deployment Protection for enhanced security requirements like E2E testing with header secrets, password protection, and private production deployments. These features aim to streamline collaboration and enhance security for preview and production deployments across all plans. The public bug bounty program for OSS projects is now available on HackerOne, inviting security researchers to find and report vulnerabilities in core Vercel open-source projects like Next.js, Nuxt, SWR, Turborepo, and the AI SDK. This program builds on a successful private bug bounty initiative and aims to reduce risk for all users of Vercel's open-source tools.

All Vercel trails
  1. The Vercel Bug Bounty Program is now publicly availableVercel is launching a unified, public bug bounty program to consolidate its private and OSS programs. This initiative aims to leverage AI to manage the increased volume of security reports and streamline the remediation process. The program covers all Vercel platform products and open-source projects, with specific hacker challenges for React2Shell and Vercel Sandbox. The security engineering team has refined its processes for report triaging, remediation, and fix verification.
  2. The Vercel OSS Bug Bounty program is now availableThe Vercel OSS bug bounty program is now publicly available on HackerOne, inviting security researchers to find vulnerabilities in Vercel's open-source projects. This program expands on a previous private initiative and covers core projects such as Next.js, Nuxt, SWR, Turborepo, and the AI SDK. The goal is to proactively identify and fix security issues, thereby reducing risk for the millions of developers and end-users who rely on these tools.
  3. Proposal for inline LLM instructions in HTML based on llms.txtIntroduces a new convention for embedding LLM instructions directly within HTML responses using `<script type="text/llms.txt">`. This convention is proposed as a mechanism for AI agents to discover and utilize authentication bypass methods for protected Vercel deployments. The post details Vercel's use case for this on its 401 pages, providing specific instructions for agents to access deployments via the Vercel MCP server or a documented bypass token URL. It also discusses the rationale for using `<script>` tags with unknown types and aligning with the `llms.txt` standard.
  4. Deployment Protection: Added security controls now available on all plansThis post introduces and expands Vercel's Deployment Protection capabilities. It details the addition of Vercel Authentication for team access, Shareable Links for external collaborators, and Advanced Deployment Protection. Advanced Deployment Protection includes a header secret for automation bypass (e.g., E2E testing), password protection, and private production deployments. The post outlines the availability of these features across different plans and their integration into the Vercel dashboard.
  5. Deployment Protection: Added security controls now available on all plansIntroduced Shareable Links (beta) for external collaborators to access preview deployments without Vercel accounts via query strings. Enhanced Advanced Deployment Protection with a header secret for programmatic access (e.g., E2E testing tools) and added Private Production Deployments (beta) to secure production environments. Replaced existing SSO Protection with Vercel Authentication for team collaboration.