Apply Vercel security best practices for secrets and access control. Use when securing API keys, implementing least privilege access, or auditing Vercel security configuration. Trigger with phrases like "vercel security", "vercel secrets", "secure vercel", "vercel API key security".
/plugin marketplace add jeremylongshore/claude-code-plugins-plus-skills/plugin install vercel-pack@claude-code-plugins-plusThis skill is limited to using the following tools:
Security best practices for Vercel API keys, tokens, and access control.
# .env (NEVER commit to git)
VERCEL_API_KEY=sk_live_***
VERCEL_SECRET=***
# .gitignore
.env
.env.local
.env.*.local
# 1. Generate new key in Vercel dashboard
# 2. Update environment variable
export VERCEL_API_KEY="new_key_here"
# 3. Verify new key works
curl -H "Authorization: Bearer ${VERCEL_API_KEY}" \
https://api.vercel.com/health
# 4. Revoke old key in dashboard
| Environment | Recommended Scopes |
|---|---|
| Development | read, deploy |
| Staging | read, write, deploy |
| Production | read, write, deploy, domains |
| Security Issue | Detection | Mitigation |
|---|---|---|
| Exposed API key | Git scanning | Rotate immediately |
| Excessive scopes | Audit logs | Reduce permissions |
| Missing rotation | Key age check | Schedule rotation |
const clients = {
reader: new VercelClient({
apiKey: process.env.VERCEL_READ_KEY,
}),
writer: new VercelClient({
apiKey: process.env.VERCEL_WRITE_KEY,
}),
};
import crypto from 'crypto';
function verifyWebhookSignature(
payload: string, signature: string, secret: string
): boolean {
const expected = crypto.createHmac('sha256', secret).update(payload).digest('hex');
return crypto.timingSafeEqual(Buffer.from(signature), Buffer.from(expected));
}
.env files in .gitignoreinterface AuditEntry {
timestamp: Date;
action: string;
userId: string;
resource: string;
result: 'success' | 'failure';
metadata?: Record<string, any>;
}
async function auditLog(entry: Omit<AuditEntry, 'timestamp'>): Promise<void> {
const log: AuditEntry = { ...entry, timestamp: new Date() };
// Log to Vercel analytics
await vercelClient.track('audit', log);
// Also log locally for compliance
console.log('[AUDIT]', JSON.stringify(log));
}
// Usage
await auditLog({
action: 'vercel.api.call',
userId: currentUser.id,
resource: '/v1/resource',
result: 'success',
});
For production deployment, see vercel-prod-checklist.