Full Sandbox egress firewall now available on Hobby plan
Vercel Sandbox's egress firewall is now available on the free Hobby plan, enabling network isolation and credential management for all users. The firewall supports allow-all, deny-all, and custom network policies with domain and IP-based rules, attachable secrets to outbound requests, and live updates via Sandbox CLI.
All firewall features are now available on the Hobby plan.Vercel Sandbox
This brings the same network isolation that protects production workloads to the free tier, giving Hobby builders control over exactly what leaves the sandbox while keeping secrets out of the code entirely. Because the firewall attaches secrets to outbound requests itself, sandboxed code can call authenticated services like without ever seeing the token.AI Gateway
Define , , or custom network policies with domain and IP-based rules, using matchers to scope each rule by path, method, query string, or headers. Custom policies can safely broker credentials or proxy requests through infrastructure you control. To get started, pass a when you create a sandbox.allow-alldeny-allnetworkPolicy
The manages the same policies, letting you update them live without restarting the sandbox.Sandbox CLI
Network policies reduce data exfiltration risk when running untrusted or AI-generated code. Learn more in the .Sandbox firewall documentation
Source: original entry ↗