Draft for review. Statuses and facts are being verified before publication.
KuraplanTrust Center
Controls

Infrastructure security

Web application firewall and DDoS protection

In placeCriticalVerified 15 September 2026ST4S S7, S11

What this control means

Vercel Firewall sits in front of the app, the API and the website: DDoS mitigation at the edge, managed web application firewall rulesets (generic, remote code execution, cross-site scripting, SQL injection), per-IP rate limits on the API, and bot challenges on the public website.

What we found

Pulled the live firewall configuration for all three Vercel projects through the Vercel API and recorded it.

How we verified it

  1. Firewall enabled on the API, the app and the website, with the managed rulesets for generic attacks, remote code execution, cross-site scripting and SQL injection active on all three.
  2. API: per-IP rate limits of 50 requests per 30 seconds for anonymous traffic and 300 per 30 seconds for signed-in traffic, plus a tighter limit on the ideas endpoint; a bypass for one school whose whole network shares an address.
  3. Website: managed bot protection with challenges, rate limits on public image generation and on sweepers, bare vercel.app hosts denied.
  4. Uploads are restricted by type and size at the application layer (images re-encoded; documents limited to PDF, text and Office formats, 25 MB).
  5. 16 September: DNSSEC enabled at the registrar and validated by public resolvers; SPF published for the transactional email domain.

Still to do

  • Add malware scanning for document uploads (planned).
  • The app project's own rate-limit rule is inactive; traffic to the API is limited instead. Decide whether to enable it.

Evidence (private, draft only): kuraplan-st4s-evidence/01-infrastructure/2026-09-15-vercel-firewall-config.md

Questions about this control: security@kuraplan.com