Project: delegacy (team: shashiraj75's projects). Affected domains: delegacy.app, www.delegacy.app, delegacy-five.vercel.app. Plan: Hobby. Deployment: 609b2a1 / dpl_Gz8BeskES2g4kW9qPPnuEi1gfXUY (Production, marked Ready).
Summary: Every route that depends on client-side hydration (dashboard, login, etc.) renders a blank white page in production. Our statically-prerendered /landing page works fine, which narrows the problem to JS chunk loading specifically.
The four shared framework/runtime chunks requested on every page load intermittently return HTTP 503:
- /_next/static/chunks/webpack-ef052acbbc214050.js
- /_next/static/chunks/fd9d1056-586b0ededc93ec79.js
- /_next/static/chunks/117-f53656f73e1db6f5.js
- /_next/static/chunks/main-app-f1a455f1c1f7388d.js
What we've already ruled out:
-
DNS / Cloudflare - delegacy.app's DNS records are DNS only (grey cloud, not proxied) at Cloudflare, confirmed by inspecting the DNS records table directly.
-
Browser-side causes - reproduced identically across Chrome (Mac), Safari (Mac), Chrome and Safari on a phone over cellular data (Wi-Fi off), and Incognito windows. Ruled out service workers, browser HTTP cache, and browser extensions.
-
Our own middleware/config - middleware.ts's matcher explicitly excludes _next/static, so it cannot be intercepting these requests. next.config.mjs has no assetPrefix/rewrites/redirects that could affect static serving.
-
Build cache - triggered a Redeploy with build cache disabled, and separately made a real source change to force new content hashes. Same 503 behavior persisted on both old and newly-hashed chunk URLs.
-
Vercel Authentication (Deployment Protection) - found this was turned ON (Require Log In, Standard Protection) under Project Settings, Deployment Protection. This explained an earlier 307 redirect on /. We turned it OFF and confirmed via Settings that it saved. This was a real bug on our end and is now fixed, but the 503s on the static chunks continued after this change.
-
Vercel Firewall / Bot Protection - Bot Protection is Inactive, 0 Custom Rules. The Firewall Overview shows only 14 total Denied requests in the last 24h, from two unrelated IPs, not from any of our test devices.
-
Vercel platform status - checked vercel-status.com, all systems including CDN and the DXB1 Dubai region we're closest to show Operational / 100% uptime, no open incidents matching this symptom.
-
CSP nonce mismatch - checked the browser console directly, zero console messages, no CSP violations logged, and the network log shows genuine HTTP 503 status codes from the server, not a client-side block.
-
Origin content itself is fine - a plain fetch() or a JS-created script tag to the exact same URL frequently returns 200 with correct, valid JS content. But the identical URL requested as part of a real page navigation fails far more often. We've seen the exact same plain URL (no query string) return both 200 and 503 across consecutive fresh navigations, with no reproducible deterministic trigger we could isolate (not concurrency - 4 parallel fetch calls all succeeded).
What we think is happening: This intermittent, non-deterministic 503 pattern on identical requests, combined with System Mitigations Active showing on our Firewall dashboard (with DDoS Mitigation: 12 hits logged this project), points to Vercel's automatic system-level DDoS/traffic mitigation intermittently flagging or rate-limiting requests for these specific static chunk paths, possibly compounded by our own repeated testing traffic to the same URLs while debugging this over a few hours.
We checked Firewall, Rules, DDoS Mitigations and System Bypasses and confirmed System Bypass Rules are IP/CIDR-based only and gated to Pro plan (we're on Hobby), so there is no dashboard-level lever available to us to exempt _next/static/chunks/* from this automatic mitigation.
One more data point: we have a sibling project on this same team/account, stocksense (stocksense360.com), on the same plan, with the identical Require Log In Vercel Authentication setting enabled, and it is loading fine with no static-asset 503s. So this does not appear to be a Vercel Authentication or account-wide configuration issue; it looks specific to the delegacy project/deployment.
What we're asking: 1) Please check the System Mitigations / edge logs for project delegacy (deployment dpl_Gz8BeskES2g4kW9qPPnuEi1gfXUY and its successors) around 2026-09-06, roughly 18:00 to 21:00 UTC, for any automatic mitigation, challenge, or rate-limit actioned against _next/static/chunks/* paths. 2) If a mitigation is active against these paths, please clear it, this is blocking real, legitimate traffic (a private family-office web app) from loading at all. 3) If there's a recommended fix on our end, please advise. We're on the Hobby plan and would prefer a fix that doesn't require upgrading if possible.
Happy to provide additional request timestamps or reproduce live if useful. Thank you!