Vercel Deployment Protection
Give ModernPentest agents access to a protected Vercel preview or staging deployment
If your staging or preview environment is behind Vercel Deployment Protection, our AI agents cannot reach your application — every request is answered by Vercel's authentication wall instead of by your app.
This guide explains why, and how to give our agents access with a Protection Bypass for Automation secret.
Deployment Protection is not the same as a WAF or bot protection. Whitelisting our IP address does not help — see WAF Bypass Configuration for that separate case.
How It Works
Deployment Protection is an authentication wall that sits in front of your deployment. It challenges every request — pages, /api/* routes, static assets, even 404s — regardless of where the request came from. Because it blocks by identity rather than by network address, no IP allowlist can satisfy it.
Vercel's own documentation notes that AI agents, CI/CD pipelines and end-to-end testing tools cannot complete the browser-based sign-in flow. The supported mechanism for automated tools is a bypass secret, sent as a request header.
Once you provide a secret, ModernPentest:
- Verifies it against your URL before storing it, so a truncated paste fails immediately
- Encrypts it at rest and sends it only to your configured host
- Attaches it as the
x-vercel-protection-bypassheader on every agent request - Adds
x-vercel-set-bypass-cookie: trueon browser navigation, so in-page navigations and form submissions stay authorized - Redacts it from activity logs, findings, and customer reports
ModernPentest probes for Deployment Protection automatically when you enter your application URL. If it is not detected, you will never be asked for a secret.
Creating a Bypass Secret
Open Deployment Protection settings
In the Vercel dashboard, go to your project → Settings → Deployment Protection.
You need the Member role on the team, or Project Administrator on the project.
Add a secret for automation
Under Protection Bypass for Automation, create a new secret and name it modernpentest.
Vercel supports multiple named secrets per project, so a dedicated one can be revoked independently without affecting your CI pipeline or test suites.
Copy the value
The secret is 32 letters and digits. Copy it in full.
Paste it into ModernPentest
In the application wizard, go to the Bot Protection step. If Deployment Protection was detected, a panel appears asking for the secret.
Paste the value and choose Verify & Save. We make a live request to your URL with the secret attached and only store it if the request actually reaches your application.
Microfrontends
If your app uses Vercel's microfrontends architecture — several projects served under one domain — you only need one secret.
Vercel verifies requests to a microfrontend host domain against the Deployment Protection settings of the default (host) application's project only. Routing to child applications happens inside the same request at the network layer, so child projects never independently re-challenge traffic arriving on the host domain.
Create the secret on the project that owns your microfrontends.json — the group's default application. That single secret covers every path under the host domain, including paths served by child projects.
One caveat worth checking: a child project's Vercel WAF rules (custom rules, IP blocking, Attack Mode) are applied additively to host-domain requests, and Vercel does not document whether a host bypass secret covers them. If you have WAF rules on any project in the group, tell us — it is the one thing that can still block a scan despite a valid secret.
Security
- The secret is encrypted at rest using AES-256-GCM and is never stored in plaintext.
- It is host-scoped: we send it only to the exact host you enrolled. It is never attached to redirects off your domain, to third-party identity providers, or to any other service.
- We send it as a header, never as a query parameter. The query form would appear in your access logs, in browser history, and in referrer headers.
- It is redacted from agent activity logs, stored findings, and generated reports.
- You can revoke it at any time in Vercel, or remove it from ModernPentest with the Remove button on the same wizard step.
We recommend regenerating the secret in Vercel once an engagement finishes. Note that regenerating or deleting a secret invalidates previously built deployments until you redeploy.
What a bypass secret does and does not do
A bypass secret lets our agents through Deployment Protection, Password Protection, Trusted IPs, and bot-protection challenges. It does not override Vercel's active DDoS mitigations, rate limits applied during a detected attack, or security challenges triggered by attack patterns.
Alternatives
| Option | Works for automation? | Notes |
|---|---|---|
| Protection Bypass for Automation | Yes — recommended | Available on all plans. Revocable. One secret covers a microfrontends group. |
| Trusted IPs | Yes, if available | Enterprise plan only. Add our static scanner IP. In preview environments Vercel requires Vercel Authentication to remain enabled alongside it. |
| Vercel Authentication (granting an account) | No | Browser SSO cannot be completed headlessly, and the resulting session cookie is scoped to a single URL and is not transferable between URLs on the same deployment. |
| Disabling Deployment Protection | Not recommended | Exposes every preview deployment in the project to the public internet for the duration of testing. |
Troubleshooting
"The secret did not get past Deployment Protection"
- Confirm the value was copied in full — it is exactly 32 letters and digits.
- Confirm it belongs to the same project that serves the URL you enrolled.
- For a microfrontends setup, confirm it was created on the group's default (host) project rather than on a child.
A scan failed with "Recon aborted — target unreachable"
We detected an authentication wall on every enrolled URL and stopped before spending any scan budget. This is deliberate: a scan that cannot see your application would otherwise report a clean result.
Add a bypass secret as described above, then re-run the pentest.
The secret worked before and stopped working
Regenerating or deleting a secret in Vercel invalidates it for previously built deployments. If you rotated the secret, update it in ModernPentest and redeploy your app in Vercel.
Frequently Asked Questions
Next Steps
- Adding Applications — enroll your app and configure surfaces
- WAF Bypass Configuration — the separate case of WAF and bot protection
- Running Pentests — start your first scan
Last updated: August 5, 2026