Before you start
You need a Guarita account and permission to install integrations in the Vercel account or team that owns the projects.
- Vercel permission — install integrations in the intended personal account or team.
- Testing authority — only authorize apps you own or have permission to assess.
- Reachable target — a public production target is needed to start the first scan.
Install the integration
From the Vercel Marketplace to the first scan, in five steps.
- 01Open Guarita from the Vercel Marketplace or from Guarita integration settings.
- 02Choose the personal account or team and grant access to all projects or selected projects.
- 03Sign in to Guarita. Login, signup, email verification, password recovery, and 2FA preserve the installation flow.
- 04Review the exact project list, select what to protect, and confirm that you are authorized to test those apps.
- 05Activate protection. Guarita verifies control and starts the first scan only when a valid public target is available.
Permissions used
Guarita requests only the Vercel resources required for installation lifecycle, project discovery, and deployment-aware scans.
| Resource | Access | Why |
|---|---|---|
| Integration Configuration | Read / Write | Validate the installation and remove it provider-first when you disconnect. |
| Projects | Read | List authorized projects and discover verified public targets. |
| Deployments | Read | Resolve production promotions and their exact deployment target. |
The base integration does not require access to environment variables, billing, domains, teams, drains, or global configuration. Deployment Checks are not required for this launch.
Project verification and the first scan
The Vercel installation is provider evidence that the selected project is under your control. It replaces manual DNS or file verification for that project.
Verification
Guarita stores revocable provider evidence for the project and periodically reconciles the installation. It never invents a *.vercel.app hostname.
First scan
A scan starts only against an exact, valid target returned by Vercel. If no reachable public target exists yet, the project remains verified and waits for one.
Production promotion scans
On Pro and Business plans, a production promotion can trigger a new authorized scan for an active project.
Production promoted
Guarita receives the signed Vercel event and resolves the exact deployment.
Authorized scan
The current project grant and target are revalidated before outbound traffic.
Clear result
The report shows whether the release is stable, regressed, blocked, or incomplete.
This automation is optional and can be disabled per project. It uses production promotion events, not every preview deployment.
Access protected previews
If a preview uses Vercel Deployment Protection, you can provide its Automation Bypass secret in Guarita project settings.
- The secret is encrypted at rest and never returned to the browser after saving.
- It is resolved by the worker only when an authorized scan starts.
- The credential is scoped to the exact preview hostname and is revoked when disabled or disconnected.
Manage, pause, or disconnect
Open Guarita Settings → Integrations, or use the Configuration URL from the Vercel dashboard.
Sync access
Refresh projects, domains, installation status, and provider evidence.
Pause a project
Stop future scans and revoke its active provider-backed scan grant.
Disconnect
Remove the Vercel configuration first, then revoke local evidence and preview access.
Disconnecting stops future provider-backed activity and discards OAuth and preview access credentials. Existing scan history remains subject to your plan's retention period.
Troubleshooting
No projects are listed
Confirm that the Vercel installation can access at least one project. For selected access, add the project in Vercel and sync the connection in Guarita.
The project is verified but no scan started
The installation proved project control, but Vercel did not return a reachable public production target. Deploy or promote the project, then sync or run the project scan.
A protected preview is blocked
Create or rotate the Automation Bypass secret in Vercel, save it in the Guarita project settings, and use “Run and test access”.
The connection is disabled
Review the installation and permissions in Vercel, then reconnect or sync. Guarita fails closed when the provider grant cannot be confirmed.
A project was removed or transferred
Guarita revokes its provider evidence. Reinstall or explicitly authorize it under the account that now controls the project.
Data and security
Guarita reads only the project and deployment information required to operate the authorized integration.
Guarita uses
- • Installation, account/team, and selected project identifiers
- • Project names and exact verified targets
- • Deployment identifiers, environments, URLs, and promotion events
- • Encrypted OAuth and optional preview access credentials
Guarita does not
- • Change source code, domains, or environment variables
- • Manufacture a target URL from a mutable project name
- • Scan an unselected project without explicit authorization
- • Expose OAuth or preview credentials in the frontend
Still blocked?
Send the project name, configuration ID, approximate time, and the exact error. Never send an OAuth token or Automation Bypass secret.