Implement Vercel lint rules, policy enforcement, and automated guardrails. Use when setting up code quality rules for Vercel integrations, implementing pre-commit hooks, or configuring CI policy checks for Vercel best practices. Trigger with phrases like "vercel policy", "vercel lint", "vercel guardrails", "vercel best practices check", "vercel eslint".
/plugin marketplace add jeremylongshore/claude-code-plugins-plus-skills/plugin install vercel-pack@claude-code-plugins-plusThis skill is limited to using the following tools:
Automated policy enforcement and guardrails for Vercel integrations.
// eslint-plugin-vercel/rules/no-hardcoded-keys.js
module.exports = {
meta: {
type: 'problem',
docs: {
description: 'Disallow hardcoded Vercel API keys',
},
fixable: 'code',
},
create(context) {
return {
Literal(node) {
if (typeof node.value === 'string') {
if (node.value.match(/^sk_(live|test)_[a-zA-Z0-9]{24,}/)) {
context.report({
node,
message: 'Hardcoded Vercel API key detected',
});
}
}
},
};
},
};
// .eslintrc.js
module.exports = {
plugins: ['vercel'],
rules: {
'vercel/no-hardcoded-keys': 'error',
'vercel/require-error-handling': 'warn',
'vercel/use-typed-client': 'warn',
},
};
# .pre-commit-config.yaml
repos:
- repo: local
hooks:
- id: vercel-secrets-check
name: Check for Vercel secrets
entry: bash -c 'git diff --cached --name-only | xargs grep -l "sk_live_" && exit 1 || exit 0'
language: system
pass_filenames: false
- id: vercel-config-validate
name: Validate Vercel configuration
entry: node scripts/validate-vercel-config.js
language: node
files: '\.vercel\.json$'
// Enforce typed configuration
interface VercelStrictConfig {
apiKey: string; // Required
environment: 'development' | 'staging' | 'production'; // Enum
timeout: number; // Required number, not optional
retries: number;
}
// Disallow any in Vercel code
// @ts-expect-error - Using any is forbidden
const client = new Client({ apiKey: any });
// Prefer this
const client = new VercelClient(config satisfies VercelStrictConfig);
# ADR-001: Vercel Client Initialization
## Status
Accepted
## Context
We need to decide how to initialize the Vercel client across our application.
## Decision
We will use the singleton pattern with lazy initialization.
## Consequences
- Pro: Single client instance, connection reuse
- Pro: Easy to mock in tests
- Con: Global state requires careful lifecycle management
## Enforcement
- ESLint rule: vercel/use-singleton-client
- CI check: grep for "new VercelClient(" outside allowed files
# vercel-policy.rego
package vercel
# Deny production API keys in non-production environments
deny[msg] {
input.environment != "production"
startswith(input.apiKey, "sk_live_")
msg := "Production API keys not allowed in non-production environment"
}
# Require minimum timeout
deny[msg] {
input.timeout < 10000
msg := sprintf("Timeout too low: %d < 10000ms minimum", [input.timeout])
}
# Require retry configuration
deny[msg] {
not input.retries
msg := "Retry configuration is required"
}
# .github/workflows/vercel-policy.yml
name: Vercel Policy Check
on: [push, pull_request]
jobs:
policy:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Check for hardcoded secrets
run: |
if grep -rE "sk_(live|test)_[a-zA-Z0-9]{24,}" --include="*.ts" --include="*.js" .; then
echo "ERROR: Hardcoded Vercel keys found"
exit 1
fi
- name: Validate configuration schema
run: |
npx ajv validate -s vercel-config.schema.json -d config/vercel/*.json
- name: Run ESLint Vercel rules
run: npx eslint --plugin vercel --rule 'vercel/no-hardcoded-keys: error' src/
// Prevent dangerous operations in production
const BLOCKED_IN_PROD = ['deleteAll', 'resetData', 'migrateDown'];
function guardVercelOperation(operation: string): void {
const isProd = process.env.NODE_ENV === 'production';
if (isProd && BLOCKED_IN_PROD.includes(operation)) {
throw new Error(`Operation '${operation}' blocked in production`);
}
}
// Rate limit protection
function guardRateLimits(requestsInWindow: number): void {
const limit = parseInt(process.env.VERCEL_RATE_LIMIT || '100');
if (requestsInWindow > limit * 0.9) {
console.warn('Approaching Vercel rate limit');
}
if (requestsInWindow >= limit) {
throw new Error('Vercel rate limit exceeded - request blocked');
}
}
Implement custom lint rules for Vercel patterns.
Set up hooks to catch issues before commit.
Implement policy-as-code in CI pipeline.
Add production safeguards for dangerous operations.
| Issue | Cause | Solution |
|---|---|---|
| ESLint rule not firing | Wrong config | Check plugin registration |
| Pre-commit skipped | --no-verify | Enforce in CI |
| Policy false positive | Regex too broad | Narrow pattern match |
| Guardrail triggered | Actual issue | Fix or whitelist |
npx eslint --plugin vercel --rule 'vercel/no-hardcoded-keys: error' src/
For architecture blueprints, see vercel-architecture-variants.