Hello Vercel team,

We are investigating a protected Preview deployment and a project-level Custom WAF rule with two AND conditions:

• Raw Path matches a regex for one dynamic API route (illustrative example only: ^/api/example/[^/]+/lookup/?$; this is not the actual route).
• Environment equals Preview.
• Action is Log (no deny, challenge, or rate limiting).

The rule was active, valid, and published before the test. The Preview deployment was Ready and contained the API route.

We issued exactly one GET through vercel curl --deployment against that protected Preview, deliberately omitting a required query parameter. The application returned its expected HTTP 400 validation error. Runtime Logs show the request was processed by the deployment with environment=preview. Firewall Traffic recorded exactly one Allow request against that path, but there was no Log action or Custom Rule attribution, including after checking the rule's traffic data again.

I understand that vercel curl automatically uses x-vercel-protection-bypass to access protected deployments. The documentation describes bypassing Deployment Protection and some other mitigation layers; I could not find a definitive explanation of the effect on project-level Custom WAF Log rules.

Could you clarify:

1. Does a valid x-vercel-protection-bypass credential skip evaluation of project-level Custom WAF rules with action Log, or only the protection layers explicitly documented?
2. Is it expected that the request is counted as Allow in Firewall Traffic but has no matching Custom Rule attribution?
3. Does Environment = Preview match a request to an immutable Preview deployment hostname accessed through vercel curl --deployment?
4. What is the recommended way to validate a Preview-only WAF Log rule without disabling Deployment Protection or unintentionally bypassing the very rule under test?

We have not repeated the test or changed the security configuration while investigating. I can provide additional non-sensitive metadata through an appropriate private support channel if needed.

Thank you.