#firewall

Amy Egan Are you using a protection bypass method? vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection P.S. Your original post is a bit long-winded, and you left in a few bits that were clearly AI-generated. Please be concise and and try to make it look like your own words when posting in the future. Other community members are more likely to answer when it feels like they're helping a person and instead of a bot 😄

Jeanloup33 Thanks, Amy. We use the existing automation bypass only for the candidate’s .vercel.app URL. No bypass is sent to the production custom domain, where we receive the direct 403 with X-Vercel-Mitigated: challenge. Is an automation bypass also recommended for that production health check? Thank you

Vercel 7723 Screenshot

Vercel 7723 Fixed. Solution was to remove trailing slashes in the paths. Done.

Amy Egan Thanks for coming back to share how you solved it!

system There's another community post with 404 debugging tips that might be helpful. Please give these solutions a try and let us know how it goes. community.vercel.com/t/debugging-404-errors/437 A human should be around soon to offer more advice. But you can also get helpful information quickly by asking v0.

Debugmyai 1042 Since your custom bypass rule didn't change anything, the managed rule seems to be inspecting the binary body no matter what. Two things worth trying: Keep the PDF out of your function entirely. Upload it straight from the browser to storage (Vercel Blob client uploads with upload() from @vercel/blob/client plus a small handleUpload route, or a presigned S3/R2 URL), then send your API only the file URL. This also gets you around the 4.5 MB request body limit on Vercel Functions, which bigger past papers would hit anyway. If the file has to go through your API, test sending it as multipart/form

Iamcaleb3rw @debugmyai-1042 The first recommendation of uploading straight from a broswer with a presigned url worked perfectly. Thank you

system The domain troubleshooting guide can help with most custom domain configuration issues. You might be able to use that guide to solve it before a human is available to help you. Then you can come back here and share the answer for bonus points. vercel.com/docs/domains/troubleshooting

Galz Update: with Logs in Live mode (no filters except path /), pressing "Scrape Again" in Meta's Sharing Debugger produces no request at all in my project's logs, while the debugger reports 403. Other visitors and crawlers show up normally with 200. My project firewall shows facebookexternalhit as allowed via a Bypass rule, Bot Protection is off, and there are no persistent actions. So Meta's crawler is being blocked at Vercel's edge before reaching the project. Can someone check the platform-level mitigation for www.offband.pro?

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Truenone This isn't a security vulnerability report. It's a request to review and unpause my Hobby project, which was paused due to a one-day usage spike from unwanted traffic. Could someone from the support team take a look? Thanks.

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

system Thank you for bringing this to our attention. To ensure this is investigated with the necessary priority and privacy, please report all security-related concerns, potential exploits, or abuse directly to the Vercel Security Team. Please submit your report here: vercel.com/abuse Reporting via this official channel is the fastest way to reach our security engineers and ensures that sensitive information is handled in a secure environment rather than a public forum.

Hali New DDOS request has been sended. 1m requests sent successfully with no deny and my project get pause

Amy Egan Were the visits from verified bots? Can we see the graph?

Ryu Hi Kemal, I’d be careful about concluding this is definitely Vercel blocking dataaccessd just from the app logs. If the request fails at TLS, redirect validation, HEAD handling, or a firewall layer before the function runs, you may also see no application log entry. For iOS Calendar, I’d test the feed like an automated calendar client instead of only from a browser: URL="gocutit.com/api/sync/calendar/example.ics" curl -i -L "$URL" curl -I -L "$URL" curl -i -L \ -A "dataaccessd/1.0" \ -H "Accept: text/calendar,*/*" \ "$URL" I’d want all of those to return a plain 200, not a challenge page, logi

Pauline P. Narvas Hey, @ninjeneer! Welcome 👋 Have you exceeded the number of IPs allowed in a single condition? I believe it allows 75 ips to be added.

Ninjeneer Hey, I wiped the rule since, but from what I remember yeah we were close to this number! I didn't know there was such limit, thanks for the insights 🙂

Flamingooreo I have the exact same issue. Getting 403 on all my subdomains ID: kix1::9t22w-1778462415363-6059aa76bf8f

Anshuman Bhardwaj Hi there, I see that there's an ongoing support thread about this and our Support team experts are sharing solutions there. To avoid miscommunication or duplicates I'll defer to them.

Mikelabs They closed my ticket and did not resolve the issue, then issued me a refund. It would be nice if someone from the Vercel team could actually address this.

Mikelabs This is still totally unresolved

Pauline P. Narvas Hi, Ahmed! Thanks for your patience. I came across your post again as I'd been reaching out to community members about our upcoming Vercel Community session. It might be relevant to you given your original post 🙂 community.vercel.com/t/how-to-protect-your-vercel-site-from-common-attacks/4652

system Hey @ahmedsaed! 👋 Just checking in on this thread. If you're still experiencing issues or have additional details to share, please let us know! We're here to help.

Pauline P. Narvas Thank you for the feedback, Sebastian! We're currently reworking the templates. We'll loop back here with updates!