I am reporting a reproducible deployment-target issue.
Expected behavior:
A deployment created with --target=preview should be classified as Preview and should not receive the Production project alias.
Actual behavior:
Vercel created a Production deployment even when the command explicitly specified --target=preview. The deployment was marked as Ready and received the Production project alias.
Environment:
Team: vertex-learning
Project: vertex-crm-preview-uat
Project ID: prj_1qQxgjtPX3k4H7YSf73OFoNHUE5W
Production Branch: main
Working branch: preview/vercel-uat-run-004
Approved commit: 2704097
Reproduction history:
Attempt 1:
No --prod or explicit Production target was used.
Deployment ID: dpl_ESG2GVWK5oz8zCkEpMjuaYyxvGtw
Resolved target: production
Attempt 2:
The command explicitly used --target=preview exactly once.
Deployment ID: dpl_8V5JKYUSqXzZUcZsxnNoZL6TGuCJ
Resolved target: production
The Production project alias was assigned.
Both deployments were immediately removed. No deployment currently remains.
We verified:
The Production Branch is main.
The working branch was not configured as Production.
Local project and team linkage were correct.
The deployable source exactly matched commit 2704097.
No --prod, --target=production, --prebuilt, deploy hook, Git-triggered duplicate, package-script override, or VERCEL_TARGET=production injection was present.
Production environment variables were empty.
The Neon integration was assigned to Preview only.
No application request, database connection, migration, seed, reset, configuration change, or secret disclosure occurred.
Could the Vercel team please investigate:
Why was the explicit --target=preview request resolved as production?
What requested target and resolved target were recorded server-side?
Does this project have any hidden, legacy, or custom environment mapping?
What corrective action will guarantee Preview classification without creating another Production deployment?
Can you confirm whether any Production-scoped resources were executed?
We will not attempt another deployment until the cause and corrective action are confirmed.
Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.
Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.
Thank you, but this is not a security, abuse, exploit, or vulnerability report.
This is a reproducible Vercel deployment-platform issue: an explicit
–target=preview deployment was classified as Production and received the
Production alias.
Please remove the security/abuse classification and route this topic to the
Vercel deployment/platform engineering team for investigation.
Several other recent Community topics appear to report similar Preview
deployments being classified as Production. We will not run another deployment
until Vercel confirms the cause and a safe corrective action.
Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.
Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.
Thank you, but this is not a security, abuse, exploit, or vulnerability report.
This is a reproducible Vercel deployment-platform issue: a deployment explicitly created with --target=preview was classified as Production and received the Production alias.
Please remove the security/abuse classification and route this topic to the Vercel deployment/platform engineering team for investigation.
We will not attempt another deployment until Vercel confirms the cause and provides a safe corrective action.
Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team.
Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.
There was no Production alias or custom domain. I immediately deleted only that deployment and confirmed the project returned to zero deployments.
This was also reproducible on an earlier first deployment without --prod.
No further deployment will be attempted until Vercel confirms why an explicit Preview target is classified as Production and provides a safe supported procedure.
It’s normal that the first deployment is automatically production, but I wasn’t able to repro with subsequent deployments. --target=preview was respected each time I deployed from my example repo’s main branch and deployments were automatically preview for my non-production branches.
Yes, it is still reproducible, but your explanation likely identifies why.
After each unexpected Production deployment, I deleted that exact deployment and confirmed the project returned to zero deployments. Therefore, every retry may have remained the project’s “first deployment”.
You can use vercel --prod --skip-domain to create a staged production deployment as a placeholder. No one, aside from yourself, will be able to access it if you still have the default Deployment Protection setting enabled.
But your idea to create two deployments before deleting the initial production version should also work just as well.