Advanced Egress Firewall Filtering for Vercel Sandbox

Vercel Sandbox has introduced a feature that enforces egress network policies through SNI (Server Name Indication) filtering and CIDR blocks. This allows precise control over which hosts a sandbox can reach.

Outbound TLS connections are checked against the policy during the handshake stage, and unauthorized destinations are blocked before any data is transmitted. By default, sandboxes have unrestricted internet access, but when running untrusted or AI-generated code, the network can be restricted to only allowlisted services to prevent data exfiltration or unintended API calls.

The key technical features are as follows.

• SNI-peeking firewall: Unlike an HTTP proxy, it supports non-HTTP protocols such as Redis or Postgres by inspecting the initial unencrypted bytes of the TLS handshake to extract the target hostname.
• IP/CIDR-based rules: Provided as a fallback for legacy systems that don't support TLS.
• Wildcard support: Makes it easy to allowlist services behind a CDN.
• Dynamic policy updates: Policies for a running sandbox can be updated in real time without restarting the process. For example, within a single session you can allow internet access to install dependencies, then lock down the network before running code, and open it again afterward.