Security settings

To adjust your project's security settings:

1. Select your project from your dashboard
2. Open Settings in the sidebar and select Security

From here you can enable or disable Attack Mode, Logs and Source Protection, Vercel Support Code Visibility and Git Fork Protection.

By default, the following paths mentioned below can only be accessed by you and authenticated members of your Vercel team:

• /_src: Displays the source code and build output.
• /_logs: Displays the build logs.

None of your existing deployments will be affected when you toggle this setting. If you’d like to make the source code or logs private on your existing deployments, the only option is to delete these deployments.

This setting is overwritten when a deployment is created using Vercel CLI with the --public option or the public property is used in vercel.json.

Vercel provides a setting that controls the visibility of your source code to our Vercel Support team. By default, this setting is disabled, ensuring that your code remains confidential and accessible only to you and your team. Our Vercel Support team might request for this setting to be enabled to troubleshoot specific issues related to your code.

If you receive a pull request from a fork of your repository, Vercel will require authorization from you or a Team Member to deploy the pull request.

This behavior protects you from leaking sensitive project information such as environment variables and the OIDC Token.

You can disable this protection in the Security section of your Project Settings.

This feature allows you to secure access to your backend services by using short-lived, non-persistent tokens that are signed by Vercel's OIDC Identity Provider (IdP).

To learn more, see Secure Backend Access with OIDC Federation.

Deployment Retention Policy allows you to set a limit on how long older deployments are kept for your project. To learn more, see Deployment Retention Policy.

This section also provides information on the recently deleted deployments