Home

Vercelsior

Open-source security scanner and configuration auditor for Vercel. Single binary, zero dependencies, Linux/macOS/Windows.

Vercelsior tests Vercel security from three angles — the only tool that does all three:

Mode	Command	Input	Perspective
Account (CSPM)	vercelsior scan	API token	Audit account/team/project config from the inside
Black-box (DAST)	vercelsior probe <url>	a URL	Test a deployed site from the outside, no token
Local (IaC/SAST)	vercelsior project [path]	a repo	Scan config/secrets pre-deploy, no token

Running vercelsior with no subcommand (or a leading flag) is an alias for vercelsior scan, so existing usage is unaffected.

Quick links

• Installation — Go, binaries, Homebrew, Scoop, Docker, source
• Scan Mode — account/team CSPM audit (needs a token)
• Probe Mode — black-box DAST against a deployed URL
• Project Mode — local pre-deploy / shift-left scanning
• Configuration — .vercelsior file and CLI flags
• Output Formats — HTML, JSON, Markdown, SARIF, diff
• CI/CD Integration — GitHub Actions + Code Scanning
• Check Reference — every check ID, severity, and risk score

What it finds

160+ checks across the three modes: leaked/over-scoped API tokens, WAF gaps, NEXT_PUBLIC_ secret leakage, plain-text/preview-exposed secrets, Next.js CVEs (incl. CVE-2025-29927 middleware bypass), SSRF in rewrites/redirects, subdomain takeover, missing security headers, exposed source maps, weak TLS/DNS hygiene, unprotected cron endpoints, and more.

Every finding carries a 1–10 risk score with written rationale, proof-of-concept evidence, a verification command, and remediation guidance.

Only probe/scan targets you are authorized to test.