Vercel Sandbox Full Outbound Firewall Now Available on Hobby Plan

All firewall features of Vercel Sandbox are now available on the Hobby plan. Even on the free plan, you can control outbound traffic from the sandbox and apply the same network isolation as in production environments.

The firewall directly injects authentication credentials into outbound requests, so sandbox code does not need to see tokens. This allows calling authentication services like AI Gateway without exposing secrets in the code.

Network policies can be configured as follows:

• allow-all, deny-all, or custom policies
• Domain and IP-based rules
• Matching by path, HTTP method, query string, and headers
• Proxying through infrastructure that adds or controls credentials for outbound requests

You can apply a policy by passing networkPolicy when creating a Sandbox, and use the Sandbox CLI to change network policies in real time without restarting the sandbox. This feature is used to reduce the risk of data exfiltration when running untrusted or AI-generated code.