Block serverless SSRF redirect and DNS bypasses
Outbound flexibility can quietly become an inbound trust problem.
Controls need to stop prohibited reachability without making ordinary integrations brittle.
“We need webhook calls to work, but I can’t ship if the network rules keep changing underneath us.”
Isha Ghosh · Staff Full-Stack Engineer
Operates payment, identity, and fulfillment integrations from server-side application routes.
What pulls against what
- network isolation vs. integration continuity
- fast containment vs. runtime consistency
- automated detection vs. verified exploitability
- strict policy vs. developer predictability
What is at stake
Confirmed egress-policy bypasses expose sensitive network boundaries. The fix must keep real third-party integrations working
Why Vercel
At Vercel, this often matters where application code connects customer experiences to external services.
Written for
This is the setup. The work is inside.
Running it puts you in the room: the full situation and its constraints, stakeholders who push back in their own words, and the decisions that are yours to make. What you produce becomes a Day One Plan — work you can show someone instead of describing.