Vercel Sandbox Makes Egress Firewall Free
Vercel is making Sandbox’s network egress firewall available on every plan, adding host and IP controls for workloads running untrusted or AI-generated code. The firewall complements Firecracker isolation by limiting where sandboxed processes can connect and what credentials they can use.
Vercel is correctly treating network access as part of the sandbox boundary, not an optional enterprise add-on.
- –SNI filtering and CIDR rules can block unauthorized destinations before data leaves the sandbox
- –Runtime policy updates support staged workflows, from dependency installation to locked-down agent execution
- –Credential brokering keeps secrets outside the sandbox while still enabling authenticated API calls
- –Proxying adds inspection, logging, and policy enforcement for sensitive outbound requests
- –The firewall is free, but outbound internet traffic and exposed-port usage can still incur charges
DISCOVERED
3h ago
2026-08-12
PUBLISHED
1d ago
2026-08-10
RELEVANCE
AUTHOR
vercel