{
  "slug": "vercel-firewall-manages-project-firewall-configuration-a4d164b8afa8",
  "title": "vercel firewall manages project firewall configuration",
  "tools": [
    "vercel"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-05-06T18:47:28.000Z",
  "announced_at": "2026-05-06T18:47:28.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When managing a project firewall, use `vercel firewall` subcommands to view and change rules, IP blocks, system bypass, attack mode, or system mitigations. Rule and IP block changes are staged; review with `vercel firewall diff` and publish with `vercel firewall publish --yes`.",
    "examples": [
      "vercel firewall rules add \"<rule-name>\" --condition '<condition-json>' --action <action> --yes",
      "vercel firewall rules edit \"<rule-name>\" --action <action> --yes\nvercel firewall rules enable \"<rule-name>\"\nvercel firewall rules disable \"<rule-name>\"\nvercel firewall rules remove \"<rule-name>\" --yes\nvercel firewall rules reorder \"<rule-name>\" --position <1-based-position> --yes",
      "vercel firewall diff\nvercel firewall publish --yes"
    ],
    "gotchas": [
      "Version: 53.2.0",
      "`rules add` positional `<rule-name>` (required): Name of the new rule.",
      "`--condition <condition-json>` (required): Condition object with required `type` and `op`; `value` is required for most operators, and `key` is required for `header`, `cookie`, or `query`. `neg` is optional and defaults to false. Repeated conditions in a group are ANDed.",
      "`--or`: Starts a new OR condition group; condition groups are ORed.",
      "`--action <action>` (required): Rule action: `deny`, `challenge`, `log`, `bypass`, `rate_limit`, or `redirect`.",
      "`--yes`: Shown in documented examples for non-interactive mutation commands; detailed flag semantics not found.",
      "`rules edit` positional `<rule-name>` (required): Name of the rule to edit; `--condition` replaces all its conditions.",
      "`--enabled` / `--disabled`: Enable or disable a rule via `rules edit`.",
      "`rules reorder` positional `<rule-name>` (required): Rule to move in evaluation priority order.",
      "`--first` / `--last` / `--position <n>` (required): Selects the destination order; the docs show these as alternatives, but do not explicitly state mutual exclusivity. Position is 1-based.",
      "`ip-blocks block <IP-or-CIDR>` (required): Blocks an IP address or CIDR; optional `--hostname <host>` scopes it to a host and `--notes <text>` adds notes.",
      "`system-bypass add <IP-or-CIDR>` (required): Adds an IP/CIDR exempt from system-level mitigations; optional `--domain <domain>` scopes it and `--notes <text>` adds notes.",
      "`attack-mode enable --duration <duration>`: Enables attack mode; documented durations are `1h` (default), `6h`, and `24h`.",
      "`system-mitigations pause` / `resume` (required): Pauses or resumes automatic system mitigations; pause auto-resumes after 24 hours.",
      "Prerequisite: Link the project first with `vercel link`.",
      "Prerequisite: System bypass is limited to Pro and Enterprise plans.",
      "Prerequisite: Attack mode enable requires interactive confirmation; the CLI documentation says it is blocked for agents/scripts."
    ]
  },
  "why_it_matters": "Manage a project's firewall configuration from the Vercel CLI.",
  "sources": [
    "https://github.com/vercel/vercel/releases/tag/vercel%4053.2.0",
    "https://vercel.com/docs/cli/firewall"
  ],
  "rank": 0.92033,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "backfill-20261007",
    "verdict_id": "backfill-20261007:backfill-20261007-d3abc390c8020e79-0:gate",
    "evidence_hash": "3dabdbf46eb96e1e23bea95524427c96278eb3277588f1ba27b63500846332c8"
  },
  "review": {
    "draft_hash": "c66f4a03ce14519822f63c98b2e5d857e5241358a1cd2470907d3d0d9e7ba0bd",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-07T00:00:00.000Z",
    "decision": "backfill-20261007:gate",
    "reason": "2 of 3 judge runs approved with p_yes >= 0.9 (mean 0.92 >= 0.9; 2 needed) and Jev gave 0.67 (>= 0.6 needed)."
  }
}