vercel security

The vercel security command runs your team's security checks and prints them in your terminal. It surfaces the same checks as your team's Security Dashboard, so you can run every check for your team, list the individual findings behind a check, and pipe the raw report into scripts or have an agent address them. Its vulnerabilities subcommand lists and triages the vulnerabilities Security Review reports.

Both run against the current team, so you need a team scope. If no team is selected, run vercel switch to choose one before running the command.

# Run all checks for the current team
vercel security
 
# List every finding across all checks
vercel security check --findings
 
# Deep-dive one check and list its findings
vercel security check [check-name]
 
# Output the raw report as JSON
vercel security check --json
 
# List open Security Review vulnerabilities
vercel security vulnerabilities

check is the default subcommand, so vercel security and vercel security check are equivalent. Both run every check for the current team and print a summary table. Pass one or more check slugs to run only those checks and list their findings.

vercel security check
vercel security check --findings
vercel security check [check-name]
vercel security check [check-name] [check-name]

The summary table has six columns: Check, Risk, Status, Violations, Muted, and Description. When any check is failing, a footer hint points you to --findings.

vercel security vulnerabilities lists and triages the vulnerabilities Security Review reports, the same ones as your team's Vulnerabilities dashboard. list is the default subcommand, so vercel security vulnerabilities lists them.

vercel security vulnerabilities
vercel security vulnerabilities inspect my-app/12
vercel security vulnerabilities dismiss my-app/12 --reason false-positive
vercel security vulnerabilities reopen my-app/12

Each vulnerability has a reference, shown in the Vulnerability column: <project>/<number> for a vulnerability in a project, or <owner>/<repo>/<number> for one in a repository. inspect, dismiss, and reopen take its reference or its vulnerability ID. If Security Review isn't enabled for the team, the command fails and says so. Which vulnerabilities you can see and change depends on your role.

Aliases: ls.

Lists the team's vulnerabilities, Production and most severe first. It shows open vulnerabilities by default, 20 at a time. The table has Vulnerability, Severity, Title, Environment, and Branch columns, plus Status when you list more than one status. When there are more vulnerabilities, the command prints the command for the next page.

Shows one vulnerability in full: its severity, status, class, environment, branch, where it was found and closed, related vulnerabilities, and a link to it in the dashboard, followed by its summary, description, and fix. Pass --json to output the whole vulnerability as JSON.

Dismisses a vulnerability as a false positive or an accepted risk. Without --reason, the command asks for the reason and an optional message in a terminal, and fails in non-interactive runs or with --json.

Dismissing a vulnerability that's already dismissed changes nothing and exits 0. With --json, the outcome is unchanged. To change a dismissed vulnerability's reason or message, reopen it and dismiss it again. Closed vulnerabilities can't be dismissed or reopened.

Reopens a dismissed vulnerability, so it's open again. Reopening an open vulnerability changes nothing and exits 0. Pass --json to output the vulnerability and the outcome as JSON.

Each check has a slug, shown as [check-name] in the examples above, and a risk level of high or medium. Pass the slug to vercel security check to run just that check.

The Status column reports one of the following values for each check. Each value maps to a card state on the Security Dashboard:

By default, vercel security check prints only the summary table. Add --findings to expand the individual findings under every check, or pass one or more check slugs to expand just those checks. Muted findings appear dimmed and tagged with (muted).

# Expand findings for all checks
vercel security check --findings
 
# Expand findings for a single check
vercel security check [check-name]

When a check has more violations than the number of findings shown, the command prints a Showing N of M findings line so you can raise the cap with --limit.

In non-interactive environments, vercel security check writes the JSON report to stdout automatically, so you don't need to pass --json. Every error path emits a structured JSON payload with a machine-readable reason and suggested follow-up commands.

The command uses two exit codes:

A failing check still exits 0, so gate a CI step on the report contents rather than the exit code.

vercel security vulnerabilities outputs JSON only with --json. When its output isn't a terminal, list prints tab-separated rows instead of a table. With --json or in non-interactive runs, errors are JSON with a machine-readable reason.

The report lists security findings such as member emails, token names, and project settings. Treat the output as sensitive: it can expose your team's security posture in CI logs or agent context, so don't write it to shared or public logs. Vulnerabilities include source code and how to exploit it, so treat their output the same way.

vercel security check --project my-app

vercel security check [check-name] --limit 200

vercel security check --json | jq '.report'

vercel security vulnerabilities --project my-app --environment production --severity critical

vercel security vulnerabilities dismiss my-app/12 --reason accepted-risk --message "Internal tool behind SSO"

• Edgenivo security overview
• Edgenivo security dashboard
• Security Review
• Access roles

The following global options can be passed when using the vercel security command:

• --cwd
• --debug
• --global-config
• --help
• --local-config
• --no-color
• --non-interactive
• --scope
• --team
• --token
• --version

For more information on global options and their usage, refer to the options section.