Hello,

I run a Next.js application on a Vercel Hobby team. On 26 October 2026, a controlled rollout was stopped because the canonical custom-domain health endpoint was challenged even while the previous application version remained active.

Direct observations

GET /api/health, with automatic redirects disabled, no authentication cookie and no protection-bypass header:

• At 10:47:35 UTC: HTTP403, HTML title Vercel Security Checkpoint.
• X-Vercel-Mitigated: challenge.
• Retry-After:30.
• A single bounded follow-up after respecting the delay returned the same classification.
• The endpoint had previously returned HTTP200 with the expected application/database health fields.

No subsequent promotion was issued. The existing live and candidate deployments were both READY in the control plane, but we did not treat READY as proof that public HTTP access worked.

What we checked

• Read-only audit data, migration ledger and project environment metadata were unchanged.
• The candidate's authorized browser checks passed; no production paid-tenant fixture or real storage upload was created for those checks.
• The candidate's unauthenticated .vercel.app health URL returns302to Vercel SSO. That is separate from the direct canonical403above.
• The project authentication scope was observed as all_except_custom_domains.
• Earlier firewall-event queries returned no corresponding actions. An active custom firewall-configuration read returned404; we do not assume that means platform protection was disabled.
• Earlier CDN logs contained successful health requests and candidate302responses, but did not recover the critical older403. We therefore distinguish those older incomplete observations from the newer direct captured challenge.

We have not changed WAF/SSO/Bot Management settings, rotated IPs/proxies/User-Agents, attempted to solve a challenge automatically or applied an automation bypass to the canonical domain. Impact from other client IPs/regions has not been established.

Questions

1. What is the supported way for Hobby users to ask Vercel to identify the mitigation decision for a specific X-Vercel-Id?
2. Can a platform-wide protection challenge produce this response without a corresponding project firewall-event record?
3. What security-preserving approach is recommended for low-volume, unauthenticated canonical health checks during a controlled rollout?
4. Which request-level evidence can we retrieve to distinguish platform mitigation from deployment-protection routing, without changing the subscription or weakening protections?

I can provide the exact requestIDs, domain and project details privately to verified Vercel staff through an official channel. They are intentionally omitted from this public post. No cookies, access tokens, automation keys or customer data are included.

Thank you.