SECURITY Signal 424
Vercel for Platforms can now deploy from your users' GitHub repositories
↗
Vercel for Platforms now allows deployments from user GitHub repositories by passing a gitAccessToken, removing the need for the Vercel GitHub App.
This change reduces friction for platform teams by letting users deploy without installing a GitHub app. However, it shifts security responsibility to the platform, which must issue read-only, scoped tokens that expire within 24 hours. Vercel encrypts the token temporarily and never stores it on the deployment, but the integrator must handle token lifecycle carefully.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
Deployments can now be created from a user's GitHub repository by passing a gitAccessToken alongside gitSource.
The token should be read-only, scoped to the requested repository, and valid for 24 hours or less.
Vercel temporarily stores the token in encrypted form for source retrieval and never stores it on the deployment.
THE CLUSTER