Skip to content

Vercel data sharing & exposure security checks

External sharing, public links, guest access, retention and data-protection settings that quietly push company data outside the tenant.

On Vercel, Black Cat runs 6 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Vercel connector needs.

Checks (6)

severity: medium Sensitive Env Var Policy Disabled fix difficulty: easy #

Enable the sensitive environment variable policy to prevent secret exposure

  1. Navigate to https://vercel.com/<team>/settings/security
  2. Locate the "Sensitive Environment Variables" section
  3. Toggle the sensitive environment variable policy to "On"
  4. Save the configuration
  5. Review existing plain-text environment variables and convert sensitive ones to the "Sensitive" type

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: low IP Visibility Enabled fix difficulty: easy #

Enable IP address hiding to prevent visitor IPs from appearing in logs

  1. Navigate to https://vercel.com/<team>/settings/security
  2. Locate the "IP Address Visibility" or "Privacy" section
  3. Enable the "Hide IP Addresses" toggle
  4. Save the configuration

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: high Public Source fix difficulty: easy #

Disable public source visibility to prevent source code from being publicly accessible

  1. Navigate to https://vercel.com/<team>/<project>/settings
  2. Locate the "Source" or "Public Source" section under General settings
  3. Disable the "Public Source" toggle
  4. Save the settings
  5. Verify the project source is no longer accessible without authentication

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-44.1 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: medium Directory Listing Enabled fix difficulty: easy #

Disable directory listing to prevent public browsing of directory contents

  1. Navigate to https://vercel.com/<team>/<project>/settings
  2. Locate the "Directory Listing" section under General settings
  3. Disable the "Directory Listing" toggle
  4. Save the settings and redeploy the project if required
  5. Verify that accessing a directory path without an index file returns a 404 instead of a listing

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: high Plain Text Secret fix difficulty: easy #

Convert sensitive environment variables to the encrypted secret type

  1. Navigate to https://vercel.com/<team>/<project>/settings/environment-variables
  2. Identify environment variables storing secrets that are set as "Plain Text"
  3. Delete the plain-text variable
  4. Re-create the variable, selecting the "Sensitive" or "Secret" type
  5. Enter the value and save; the value will be encrypted at rest and masked in logs
  6. Redeploy the project to apply the updated variable type

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

severity: medium Exposed to Preview fix difficulty: easy #

Remove preview environment target from sensitive environment variables

  1. Navigate to https://vercel.com/<team>/<project>/settings/environment-variables
  2. Locate the sensitive or secret environment variable that targets the "Preview" environment
  3. Edit the variable and deselect "Preview" from the target environments
  4. If preview deployments genuinely need a value, create a separate non-sensitive variable with a safe placeholder value
  5. Save the changes and redeploy to apply the updated targets

Vendor docs ↗

Satisfies: ISO 27001:2022 A.8.12 SOC 2 Type II CC6.7 CIS Controls v8 CIS-03.1 NIST CSF 2.0 PR.DS-01 GDPR (SaaS Security) GDPR-5.1f.iii HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.a.3 DORA (SaaS Security) DORA-9.11

More Vercel checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial