diff --git a/cloud/integrations.mdx b/cloud/integrations.mdx index 928a6ac4..a66ad555 100644 --- a/cloud/integrations.mdx +++ b/cloud/integrations.mdx @@ -53,6 +53,9 @@ icon: "plug-circle-plus" + + + @@ -2121,3 +2124,72 @@ References: 1. https://docs.digitalocean.com/reference/api/create-personal-access-token/ 2. https://docs.digitalocean.com/reference/api/ + +### Vercel + + + Click here to open the Vercel integration configuration page in the ProjectDiscovery Cloud platform + + +Vercel Integration Screen + +ProjectDiscovery's Vercel integration pulls the hostnames Vercel serves for your projects into your asset inventory, so the frontends your team ships continuously are scanned alongside the rest of your attack surface. Like the other cloud integrations it runs on ProjectDiscovery's open-source **Cloudlist** engine, reading the Vercel REST API with a token you supply. + +Supported Vercel Services: + +| Service | Description | +| :------------------------------------------------------------ | :------------------------------------------------------------------------- | +| [Deployments](https://vercel.com/docs/deployments) | Deployment hostnames from each project's latest deployments, flagged public or private | +| [Domains](https://vercel.com/docs/domains) | Production domain aliases assigned to each project | + +**Create the token in Vercel** + +- Set the scope selector in the Vercel dashboard to your personal account rather than a team, then open the [Account Tokens page ↗](https://vercel.com/account/tokens). +- Click **Create Token** and enter a descriptive name. +- Open the **Scope** dropdown and choose how far the token reaches. See the table below for how each choice behaves here. +- Choose an **Expiration** and click **Create**. +- Copy the token now. Vercel shows the value once, prefixed `vcp_`. + + + Some Vercel teams require two-factor authentication or SAML before a token can be scoped to them. The Vercel dashboard tells you when you select such a team. + + +**Choosing a scope** + +| Token scope | What ProjectDiscovery enumerates | Team ID field | +| :--------------------------------------------------- | :------------------------------------------------------------ | :---------------------------------- | +| **Team** (select the team, then **All Projects**) | Every project in that team | Leave empty | +| **Full Account** | Your personal account's projects, unless you supply a Team ID | Required to reach a team's projects | +| **Project** | That single project only | Leave empty | + +**Connect it in ProjectDiscovery** + +- Enter the token as **API Access Token**. +- Enter a **Team ID** (`team_xxx`, shown in Vercel under **Team Settings → General**) only when you are using a Full Account token and want a team's projects. Team-scoped and project-scoped tokens already carry their team, so leave the field empty for those. +- Give a unique **Integration Name**, set a discovery **Frequency** or keep the daily default, and click **Verify**. + +Both services are enumerated by default. To restrict an integration to one of them, create it from [Integrations](https://cloud.projectdiscovery.io/integrations) instead, where the connection form exposes a **Services** selector, or set `services` directly in a Cloudlist configuration as shown in [Cloudlist Providers](/opensource/cloudlist/providers#vercel). + + + A team-scoped token is the least-privilege choice for this integration. It reaches one team, needs no Team ID, and can be revoked without disturbing your other Vercel automation. Pair it with the shortest expiration your rotation schedule allows. + + + + Vercel access tokens have no read-only permission setting. A token carries the permissions of the account that created it, within the scope you select, so scope and expiry are the only controls available to you. ProjectDiscovery issues read requests only. + + +**What this integration does not cover** + +- **Full deployment history**: only the deployments Vercel reports as a project's latest are enumerated, not every deployment ever created for that project. +- **Preview and branch aliases**: domains are read from each project's production target, so aliases pointing at preview or branch environments are not enumerated. +- **The shared `vercel.app` suffix**: the integration reads the projects your token can see. It does not enumerate the wider `*.vercel.app` public suffix. + +References: + +1. https://vercel.com/docs/accounts/access-tokens +2. https://vercel.com/docs/rest-api diff --git a/images/Vercel_integration_screen.png b/images/Vercel_integration_screen.png new file mode 100644 index 00000000..917b8652 Binary files /dev/null and b/images/Vercel_integration_screen.png differ diff --git a/opensource/cloudlist/providers.mdx b/opensource/cloudlist/providers.mdx index 74551933..484e7b8a 100644 --- a/opensource/cloudlist/providers.mdx +++ b/opensource/cloudlist/providers.mdx @@ -440,6 +440,39 @@ Linode can be integrated by using the following configuration block. References: 1. https://www.linode.com/docs/guides/getting-started-with-the-linode-api/#get-an-access-token +### Vercel + +Supported Vercel Services: + - Deployments + - Domains + +**Example Config:** + +Vercel can be integrated by using the following configuration block. + +```yaml +- provider: vercel # provider is the name of the provider + # id is the name defined by user for filtering (optional) + id: staging + # vercel_api_token is the access token for the vercel account + vercel_api_token: $VERCEL_API_TOKEN + # vercel_team_id scopes enumeration to a team, only needed with a + # Full Account token (optional) + vercel_team_id: $VERCEL_TEAM_ID + # services to enumerate, defaults to all (optional) + services: + - deployments + - domains +``` + +`vercel_api_token` can be created from https://vercel.com/account/tokens. Vercel tokens have no read-only setting, so the available control is scope: a **Team** token (select the team, then **All Projects**) reaches one team and needs no `vercel_team_id`. A **Full Account** token needs `vercel_team_id` to reach a team's projects, and a **Project** token returns only that project. + +`deployments` returns the hostnames of each project's latest deployments, not its full deployment history. `domains` returns the aliases on each project's production target, so preview and branch aliases are not included. + +References: +1. https://vercel.com/docs/accounts/access-tokens +2. https://vercel.com/docs/rest-api + ## CDN & DNS Management ### Fastly