Secure Vercel with cnspec

Scan your Vercel teams and projects to find security risks before they become incidents. cnspec evaluates deployment protection, environment variable exposure, SAML enforcement, firewall configuration, access token hygiene, and dozens of other Vercel controls.

If you're new to cnspec, start with the Quickstart. For an overview of every SaaS service cnspec can scan, see the SaaS scanning overview.

Prerequisites

To scan Vercel with cnspec, you must have:

• cnspec installed on your workstation
• A Vercel account with access to the teams and projects you want to scan
• A Vercel API token

Authenticate

cnspec connects to Vercel using an API token. To create one:

1. Log in to the Vercel dashboard.
2. Go to Account Settings > Tokens.
3. Create a token, set its scope and expiration, and copy the value.

You can pass the token on the command line with --token, or export it once and reuse it across commands:

export VERCEL_TOKEN=YOUR_TOKEN

cnspec also accepts VERCEL_API_TOKEN. When either variable is set, you can omit the --token flag from the commands below.

By default cnspec discovers every team the token can access, along with the projects owned by those teams. To scope a scan to a single team, pass its slug or ID with --team.

Note: Vercel projects owned by a personal account (not a team) aren't discovered automatically. Use a team-owned project, or pass --team to target a specific team.

Connection options

Verify with a quick Vercel check

Confirm that cnspec can reach your Vercel account by opening a cnspec shell:

cnspec shell vercel --token YOUR_TOKEN

cnspec> vercel.currentUser { username email }
vercel.currentUser: {
  username: "acme-admin"
  email: "admin@example.com"
}

If cnspec connects and shows your account, you're ready to scan.

Scan Vercel

cnspec scan vercel --token YOUR_TOKEN

To scan a single team:

cnspec scan vercel --token YOUR_TOKEN --team acme

When a scan completes, cnspec prints a summary of all the checks it ran, grouped by policy, along with a risk score from 0 (no risk) to 100 (highest risk). Failed checks include remediation guidance to help you fix issues. To learn more about reading scan results, read Understand cnspec Results.

Scan with the Mondoo Vercel Security policy

Mondoo maintains an out-of-the-box Vercel Security policy that checks deployment protection, environment variable exposure, SAML enforcement, firewall configuration, access token hygiene, and more.

Mondoo Platform users: Enable the policy in your space. In the Mondoo App, go to Findings > Policies, search for "Vercel", and add the policy. To learn more, read Manage policies in Mondoo Platform.

Open source users: Pass the policy bundle URL directly to cnspec:

cnspec scan vercel --token YOUR_TOKEN \
  --policy-bundle https://raw.githubusercontent.com/mondoohq/cnspec/refs/heads/main/content/mondoo-vercel-security.mql.yaml

You can also create your own policies to meet your specific requirements.

Explore and test checks interactively

Open a cnspec shell to discover resources and try out checks:

cnspec shell vercel --token YOUR_TOKEN

List all teams

cnspec> vercel.teams { slug name samlEnforced }
vercel.teams: [
  0: {
    slug: "acme"
    name: "Acme Inc"
    samlEnforced: true
  }
]

List all projects

cnspec> vercel.projects { name framework }

Inspect a project's environment variables

Vercel never returns the values of environment variables, only their key, type, and targets:

cnspec> vercel.projects[0].environmentVariables { key type target }

List API access tokens

cnspec> vercel.accessTokens { name origin expiresAt }

Example security checks

Ensure all teams enforce SAML SSO

cnspec> vercel.teams.all(samlEnforced == true)
[ok] value: true

Ensure teams enforce a policy for sensitive environment variables

cnspec> vercel.teams.all(sensitiveEnvironmentVariablePolicy == "on")
[ok] value: true

Ensure no environment variables are stored in plaintext

Variables with the plain type are stored and returned in clear text:

cnspec> vercel.projects.all(environmentVariables.none(type == "plain"))
[ok] value: true

Ensure deployment protection is enabled

A null ssoProtectionDeploymentType means deployment protection is disabled:

cnspec> vercel.projects.all(ssoProtectionDeploymentType != null)
[ok] value: true

Ensure Git fork protection is enabled

cnspec> vercel.projects.all(gitForkProtection == true)
[ok] value: true

Ensure API access tokens have an expiration

A null expiresAt means the token never expires:

cnspec> vercel.accessTokens.all(expiresAt != null)
[ok] value: true

Learn more

• Vercel Resource Pack Reference: every Vercel resource and field cnspec can query
• Write Effective MQL: guide to authoring checks and queries