Protect deployments and access

A deployment URL can expose unfinished features or test data. A broad token or team role can change every project in its scope.

Require strong account authentication, use the smallest team role, scope automation tokens narrowly, rotate unused credentials, and review connected Git and marketplace integrations. Use deployment protection appropriate to the data and audience. Do not put real customer data into Preview merely because the preview itself is hard to guess.

Draw the access path for a release: Git provider, Vercel team, project, automation token, Preview viewer, domain administrator, and external data store. Remove access at the narrowest point and verify that recovery still has at least one accountable owner. A token used by one project should not be able to deploy every team project.

Deployment protection can cover Preview or generated deployment URLs without making the production domain private. Test each hostname and environment from a signed-out session. Protection also does not sanitize the connected data, so keep Preview credentials and datasets separate even when authentication is required.

Review project members, tokens, Git access, integrations, and preview visibility. Remove one unnecessary permission or document why each remaining one exists.