vercel-policy-guardrails

# Vercel Policy Guardrails ## Overview Protect against common Vercel failure modes with automated guardrails: ESLint rules preventing secret exposure in client bundles, pre-commit hooks scanning for credentials, CI checks validating vercel.json and edge runtime compatibility, and runtime middleware enforcing auth on protected routes. ## Prerequisites - ESLint configured in project - Git hooks infrastructure (husky or lefthook) - CI/CD pipeline (GitHub Actions or similar) - TypeScript for type enforcement ## Instructions ### Step 1: ESLint Rules — Prevent Secret Exposure ```javascript // .eslintrc.js — custom rules for Vercel projects module.exports = { rules: { // Prevent using NEXT_PUBLIC_ prefix for sensitive variables 'no-restricted-syntax': [ 'error', { selector: 'MemberExpression[object.property.name="env"][property.name=/^NEXT_PUBLIC_(SECRET|KEY|TOKEN|PASSWORD|PRIVATE)/]', message: 'Do not prefix secrets with NEXT_PUBLIC_ — they will be exposed in the client bundle', }, ], }, overrides: [ { // Edge runtime files — prevent Node.js API usage files: ['**/edge-*.ts', '**/middleware.ts'], rules: { 'no-restricted-imports': [ 'error', { paths: [ { name: 'fs', message: 'fs is not available in Edge Runtime. Use fetch or Vercel Blob.' }, { name: 'path', message: 'path is not available in Edge Runtime. Use URL API.' }, { na...