OpenAI Codex security directory

Vercel

Published by Vercel Labs

High risk

Combines Vercel development guidance with connected project and deployment access. Build web apps and AI agents using Next.js, React, Vercel services and integrations. Deploy, troubleshoot and monitor applications, including configuration, storage and performance.

Security assessment

Plutonium assessed this plugin for permissions, capabilities, and security-relevant behavior.

  • Automates arbitrary web pages and form interactions: Can programmatically control a browser, including navigation, form input, clicks, capture, or page inspection.
  • Deploys, promotes, rolls back and reconfigures Vercel production: Can deploy code, applications, containers, workflows, or infrastructure to a persistent environment.
  • Removes environment variables, integrations, storage and cache/resources: Can delete records, files, projects, messages, or resources that may be difficult to recover.
  • Creates secrets and manages access, keys and security controls: Can create or change persistent records, files, projects, permissions, settings, or credentials.
  • Runs arbitrary project builds, scripts, database jobs and sandboxes: Can execute code, commands, scripts, unrestricted queries, or dynamic gateway actions.
  • Sends transactional/bulk email through provisioned integrations: Can send messages, comments, invitations, posts, or published content attributed to the connected user.
  • Can buy domains and provision billable integrations/resources: Can initiate purchases, paid jobs, payments, refunds, infrastructure spend, or other financial activity.

Available capabilities

This add-on exposes 54 tools or capabilities.

  • agent-browser
  • agent-browser-verify
  • ai-elements
  • ai-gateway
  • ai-generation-persistence
  • ai-sdk
  • auth
  • bootstrap
  • cdn-caching
  • chat-sdk
  • cms
  • cron-jobs
  • deployments-cicd
  • email
  • env-vars
  • eve
  • geist
  • geistdocs
  • investigation-mode
  • json-render
  • knowledge-update
  • marketplace
  • micro
  • microfrontends

The interactive security report will load automatically.