vercel-speed-audit

The fragment documents a legitimate GitHub Actions-to-Vercel deployment pattern and contains no apparent malware or deliberate data theft. The principal security risk is executing untrusted pull-request-controlled code in a workflow that may have access to Vercel credentials and environment data. Preview deployments should use a trusted event or a separate approval-gated workflow, minimize permissions and secrets, and avoid exposing credentials to untrusted builds. Pin the Vercel CLI version and safely pass deployment output to github-script.