system There's another community post with 404 debugging tips that might be helpful. Please give these solutions a try and let us know how it goes. community.vercel.com/t/debugging-404-errors/437 A human should be around soon to offer more advice. But you can also get helpful information quickly by asking v0.

Pasha Thank you for the reference. I checked the suggested article, but I believe our issue is different from a typical deployment or website routing 404. The error occurs when the existing Vercel Connector calls the Vercel REST API: GET api.vercel.com/v2/user Response: 404 / not_found / User not found I have independently verified in the Vercel Dashboard that my account is an Owner of the relevant Team. The issue appears to involve the Connector's authorization principal or identity mapping, rather than a missing website page or deployment route. Could a Vercel Connect engineer or maintainer please

Melbourn74 Dev One addition: if it helps free up storage, please feel free to remove all of our older deployments, including those in Recently Deleted. Please keep only the current production deployment and the latest staging deployment. We don't need to restore or roll back to any older deployments.

Frantisek Following up: the Vercel Support Agent reports that pre-ingestion/storage redaction of specific Runtime Logs query parameters is unsupported across all plans. The Agent offered a support case, but the form directs Hobby users back to Community for Observability → Logs support. Could a Vercel staff member confirm the redaction limitation and clarify whether Hobby’s one-hour retention means query availability or deletion of underlying request metadata, particularly given the documented availability of older logs after upgrading? My reproduction used fake values only. Deployed OAuth remains disab

Solvion Holdings Not staff, so I can't speak to Vercel's storage. But with PKCE, a logged code and state are low value on their own, and you can make that hold in your app: The code can't be redeemed alone. Spotify's PKCE token request needs the code_verifier your app generated (that interception case is why RFC 7636 exists). Keep the verifier out of the URL: store it in an httpOnly, Secure, SameSite=Lax cookie, delete it after the exchange, and never log cookies. It's single-use and short-lived. RFC 6749 §4.1.2 says a code must expire shortly (10 min max recommended) and must not be used twice. Exchange it in

Amy Egan You can set a team-wide Deployment Protection default. If you pick All Deployments, every new project is protected from the moment it's created. Without a team default, new projects start on Standard Protection, which covers previews but not production domains. Vercel Authentication, All Deployments, and Protection Bypass for Automation are included on every plan WAF custom rules can match on method, path, hostname, header and more, and can deny or challenge matching requests. Changes go live without a redeploy. But it sounds like Deployment Protection with All Deployments is the better option

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Amy Egan You can choose another free *.vercel.app from those currently available or purchase a custom domain if you want more control. Custom domains are available through vercel.com/domains or third-party registrars. Your custom domain can be used with your project either way vercel.com/docs/domains/working-with-domains/add-a-domain

Amy Egan You can use the filter in your Deployments list to find it 😃

Amy Egan Sorry to hear you had some unexpected high usage, @pabloost. Do you have a support case open? The community isn't able to issue refunds. For security reasons, that kind of thing is limited to the support team. If you don't have a case yet, please open one at vercel.com/help so the support team can assist

Pablo Hey! Thanks for your help. Unfortunately, I can´t as an agents responds automatically without the option to talk with support team :-(

Amy Egan It should let you open a case if you ask to talk to a person. Can you try again and let me know what it tells you if it doesn't help you open a case?

Amy Egan Hey Greg. The support team let me know they've been in contact through your support case. Please follow up with them if you have any more questions so they can help

QuantumForgeAI Quick update: our protected deployment's route and lock checks now pass, and the temporary automation token was revoked with removal verified. We still need the configuration evidence before proceeding. What is the supported read-only way to verify the non-secret settings applied to a specific existing deployment, plus a complete credential-name inventory, without exposing secret values? The deployment-specific env pull returned HTTP 400. Current project settings do not establish that deployment's snapshot, and hidden or omitted Secret values do not establish absence. We also need to understan

system There's another community post with 404 debugging tips that might be helpful. Please give these solutions a try and let us know how it goes. community.vercel.com/t/debugging-404-errors/437 A human should be around soon to offer more advice. But you can also get helpful information quickly by asking v0.

Omediae Following up on this unresolved question. Could someone from the Firewall team clarify: What supported operation creates the first unpublished firewall draft without activating it? The REST reference and CLI use different endpoints. Does PUT /config stage or immediately activate configuration? What JSON shape supports a fixed-window SDK rule with an over-limit Log action and API-controlled keys? Is environment=preview supported for SDK rate-limit requests? We understand Hobby’s one-rate-limit-rule allowance and three-custom-rule ceiling. We’re seeking a safe, supported single-rule test—not add