vercel-deploy-button
Warn
Audited by Snyk on Jun 20, 2026
Risk Level: MEDIUM
Full Analysis
MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).
- Potentially malicious external URL detected (high risk: 0.90). The deploy button (https://vercel.com/new/clone) uses the required repository-url (e.g. https://github.com/OWNER/REPO or https://github.com/yourco/template) at runtime to clone and build that remote Git repo on Vercel, which executes remote code and is a required dependency for the flow.
Issues (1)
W012
MEDIUMUnverifiable external dependency detected (runtime URL that controls agent).
Audit Metadata