Domain: denchinonihongo.app Plan: Hobby

The problem:

My production site keeps getting hit by Attack Challenge Mode, which blocks /.well-known/assetlinks.json with a 403 and the header X-Vercel-Mitigated: challenge. This file is required for Android Digital Asset Links verification — my TWA app (~80 real users on Play Store) depends on it to run in fullscreen mode. When the file returns a challenge instead of JSON, Android stops trusting the app and it falls back to showing as a Chrome Custom Tab with the URL bar visible.

This has happened multiple times in the same week, intermittently, without any unusual traffic pattern on my end — sometimes triggered just by a normal git push deploy.

What I've tried (all unsuccessful):

• Manual redeploy — doesn't fix it
• Custom WAF Rule with Bypass action for /.well-known/* — the UI warns that custom bypass rules don't override "system mitigations", and it didn't work
• System Bypass Rules — only allows bypass by IP/CIDR, not by path. This doesn't help because Digital Asset Links verification comes from Google/Android infrastructure with unpredictable IPs.

The issue:

On the Hobby plan, there's no way to create a path-based System Bypass Rule. The only option suggested was upgrading to Pro ($20/month) indefinitely just to maintain a bypass rule for a single static JSON file — which isn't a reasonable solution for this use case.

My request:

Files in /.well-known/* are standard verification files (Digital Asset Links, Apple App Site Association, security.txt, etc.) that are queried by automated infrastructure, not human browsers. They have no attack surface — no code execution, no user input, just static read-only JSON.

Could Vercel consider either:

1. Exempting /.well-known/* from Attack Challenge Mode by default (platform-wide), or
2. Allowing a manual exception for my domain?

This would benefit anyone running a TWA, iOS universal links, or other apps that rely on these standard verification files.

Thanks!