How to Keep a New Vercel Project Private Before Its First Deploy
1What happened
the owner wanted a private preview of a new design. Our build agent made a new project on Vercel, the host we use for websites, and deployed it. On Vercel, the first deploy of a new project goes to its public address. Protection wasn't on yet, so anyone with the address could have seen it for about 4 minutes.
2What we did
Took the public version down right away.
Turned on Vercel's login wall for the project before deploying anything else.
For buildersProject Settings > Deployment Protection > Vercel Authentication.Made one private share link, so the owner could see the preview without a Vercel account.
For buildersDeployment Protection > Protection Bypass for Automation. The link carries x-vercel-protection-bypass and x-vercel-set-bypass-cookie in the address.Treated that link like a password: anyone who has it can open the preview, and the link lands in browser history and logs. Share it only in private, and make a new bypass secret when the preview is done.
Deployed again as a preview only, never to the public address.
New rule: turn protection on before the first deploy of any private project.
3How we know it worked
without the share link, the address sends you to Vercel's login. With it, the page opens. The project's public address shows only Vercel's "Nothing here" page.
4What you can take from it
on a new Vercel project, turn on Deployment Protection before your first deploy, not after.
