Hi Vercel team, My project HadyLink-Web (production domain: hadylink.vercel.app) has been serving a persistent. Vercel Security Checkpoint (HTTP 403 with x-vercel-mitigated: challenge header) to automatedl requests for more than 24 hours — even for a single plain GET request to a public API route, e.g.: GET https://hadylink.vercel.app/api/hady/translate?q=halo&country=en → 403 "Vercel Security Checkpoint" (challenge page) This is a free & public API ("Non ApiKey"), so API clients such as curl, bots, and third-party apps are legitimate and expected traffic — they were working fine before. What I have already checked/done:

1. Attack Challenge Mode is OFF — the Firewall card shows the red "Enable Attack Challenge Mode" button (i.e. it is disabled).

2. Vercel Authentication is Standard (previews only) — production is public, so this is not Deployment Protection.

3. Protection Bypass for Automation is enabled in project settings, and I tested with the generated secret via both: - header: x-vercel-protection-bypass: - query parameter: ?x-vercel-protection-bypass= - …the response is still 403 + x-vercel-mitigated: challenge. 4. Redeployed the project after creating the secret — no change. 5. Tried distinct User-Agent (browser-like) and both hadylink.vercel.app and recent deployment URLs.

   Request: Please review the firewall/attack-mitigation flags associated with my domain ( hadylink.vercel.app) and, if a challenge/attack pattern flag was triggered (possibly by earlier traffic spikes), help me reset it. My intention is to keep normal bot protection for website visitors but allow plain automated requests to /api/* as before.

   Project name: HadyLink-Web (Vercel account: hadinih1773) Example blocked request timestamp: 2026-11-07 (several times across Nov 6–7)

   Thanks! Hady