--- title: Penetration testing on Vercel description: Learn how to perform pentesting on Vercel. url: /kb/guide/penetration-testing-on-vercel canonical_url: "https://vercel.com/kb/guide/penetration-testing-on-vercel" published: 2025-11-03 last_updated: 2026-07-30 authors: DX Team related: - /docs/limits/fair-use-guidelines - /docs/security/vercel-waf/rule-configuration - /docs/security/vercel-waf/custom-rules - /docs/manage-cdn-usage - /docs/functions/usage-and-pricing - /docs/global-config install_vercel_plugin: npx plugins add vercel/vercel-plugin --- ## Related pages > **For AI agents:** Follow these links to understand how this page connects to the rest of the Vercel ecosystem. For the full cross-link map (inbound, outbound, prerequisites, and semantic neighbors), see the .graph.md link below. - [Overview](https://vercel.com/docs/security?from=related) — Vercel provides built-in and customizable features to ensure that your site is secure. - [Security & Compliance Measures](https://vercel.com/docs/security/compliance?from=related) — Learn about the protection and compliance measures Vercel takes to ensure the security of your data, including DDoS miti - [DDoS Mitigation](https://vercel.com/docs/vercel-firewall/ddos-mitigation?from=related) — Learn how the Vercel Firewall mitigates against DoS and DDoS attacks - [Web Application Firewall](https://vercel.com/docs/vercel-firewall/vercel-waf?from=related) — Learn how to secure your website with the Vercel Web Application Firewall \(WAF\) - [Firewall](https://vercel.com/docs/vercel-firewall?from=related) — Learn how Vercel Firewall helps protect your applications and websites from malicious attacks and unauthorized access. - [Ensuring safe and effective infrastructure testing](https://vercel.com/kb/guide/ensuring-safe-and-effective-infrastructure-testing?from=related) — We conduct regular penetration testing through certified third-party assessors to secure the Vercel platform. This guide - [What is Vercel's policy regarding load testing deployments?](https://vercel.com/kb/guide/what-s-vercel-s-policy-regarding-load-testing-deployments?from=related) — Learn about Vercel's policies regarding load tests. - [How to Effectively Load Test Your Vercel Application](https://vercel.com/kb/guide/how-to-effectively-load-test-your-vercel-application?from=related) — Learn how to safely load test your Next.js app on Vercel. This guide covers realistic, policy-compliant testing of route - [How to conduct PCI scans on Vercel: A complete guide to IP safelisting](https://vercel.com/kb/guide/how-to-conduct-pci-scans-on-vercel-guide?from=related) — Scan and verify your Vercel deployments for secure, PCI-compliant payment processing. Full cross-link map for this page: [/kb/guide/penetration-testing-on-vercel.graph.md](/kb/guide/penetration-testing-on-vercel.graph.md) When you host a website online, you should perform security assurance to protect your company and your customers. One common method is to conduct “penetration testing” - simulating attacks on your website to identify security weaknesses. ## Who can perform penetration testing? Penetration testing is authorized for both Pro and Enterprise customers. This is not permitted for Hobby users. For more information, please consult our [Fair Use Guidelines](https://vercel.com/docs/limits/fair-use-guidelines). ## What can you test? Pro and Enterprise customers are permitted to test their own applications hosted on Vercel. However, customers must not target the underlying hosting infrastructure and platform. Vercel performs continual security assurance activities against our underlying platform, including penetration testing. Recent pentest reports are available to our Pro and Enterprise customers at [https://security.vercel.com](https://security.vercel.com). ## Volumetric vs non-volumetric Only Enterprise customers can perform volumetric penetration testing (e.g. sending a large number of requests from an automated scanner), and you must notify Vercel in advance through your Customer Success Manager (CSM) or Account Executive (AE). > Volumetric testing has some crossover with **load testing**, which you can > > read more about in [What is Vercel's policy regarding load testing deployments](/guides/what-s-vercel-s-policy-regarding-load-testing-deployments). Both Pro and Enterprise customers can perform non-volumetric penetration testing without notifying Vercel in advance. ## Downstream suppliers Consider how penetration testing might affect your downstream suppliers (e.g. backend or database hosting providers), and obtain consent from all relevant parties. ## Vercel WAF bypass We recommend that you [set any IP addresses used for penetration testing to Bypass](https://vercel.com/docs/security/vercel-waf/rule-configuration#actions) in your project's [WAF configuration](https://vercel.com/docs/security/vercel-waf/custom-rules) to ensure no other user-configured rules block the testing activity. ## Costs incurred Customers are responsible for all variable costs associated to penetration testing activities (e.g. [Fast Data Transfer](/docs/manage-cdn-usage#fast-data-transfer), [Function Invocations](/docs/functions/usage-and-pricing#managing-function-invocations), [Global Config reads](https://vercel.com/docs/global-config)). ## More resources - [What is Vercel's policy regarding load testing deployments?](/guides/what-s-vercel-s-policy-regarding-load-testing-deployments)