Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Thank you, but this is not a security, abuse, exploit, or vulnerability report.

This is a reproducible Vercel deployment-platform issue: an explicit --target=preview deployment was classified as Production and received the Production alias.

Please remove the security/abuse classification and route this topic to the Vercel deployment/platform engineering team for investigation.

Several other recent Community topics appear to report similar Preview deployments being classified as Production. We will not run another deployment until Vercel confirms the cause and a safe corrective action.

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Thank you, but this is not a security, abuse, exploit, or vulnerability report.

This is a reproducible Vercel deployment-platform issue: a deployment explicitly created with --target=preview was classified as Production and received the Production alias.

Please remove the security/abuse classification and route this topic to the Vercel deployment/platform engineering team for investigation.

We will not attempt another deployment until Vercel confirms the cause and provides a safe corrective action.

Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.

Please submit your report here: vercel.com/abuse

Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

I can confirm the same issue on a fresh project using Vercel CLI 56.5.0.

Project conditions:

• Zero existing deployments

• No Git integration

• No custom domains

• No Production environment variables

• Standard Protection enabled

Commands: vercel build --target=preview vercel deploy --prebuilt --target=preview

The local build correctly targeted Preview, but the resulting deployment metadata reported production.

Unexpected deployment: dpl_8F94QwoZUvd3Sb6XMXgns58VfEWo

There was no Production alias or custom domain. I immediately deleted only that deployment and confirmed the project returned to zero deployments.

This was also reproducible on an earlier first deployment without --prod.

No further deployment will be attempted until Vercel confirms why an explicit Preview target is classified as Production and provides a safe supported procedure.

It's normal that the first deployment is automatically production, but I wasn't able to repro with subsequent deployments. --target=preview was respected each time I deployed from my example repo's main branch and deployments were automatically preview for my non-production branches.

Is this still happening to you?

Yes, it is still reproducible, but your explanation likely identifies why.

After each unexpected Production deployment, I deleted that exact deployment and confirmed the project returned to zero deployments. Therefore, every retry may have remained the project’s “first deployment”.

The second attempt explicitly used:

vercel build --target=preview vercel deploy --prebuilt --target=preview

But because the previous deployment had been deleted, the project again had zero deployments before this attempt.

Could you please confirm the supported safe procedure?

Should we:

1. Allow the automatically created first Production deployment to remain temporarily,

2. Create a second deployment using --target=preview,

3. Verify that the second deployment is classified as Preview,

4. Then delete only the initial Production deployment?

Alternatively, is there a supported way to initialize a new project directly with a Preview deployment without creating any Production deployment?

We will not retry until you confirm the safe procedure.

You can use vercel --prod --skip-domain to create a staged production deployment as a placeholder. No one, aside from yourself, will be able to access it if you still have the default Deployment Protection setting enabled.

https://vercel.com/docs/cli/deploy#skip-domain

But your idea to create two deployments before deleting the initial production version should also work just as well.

I hope that helps!