Vercel WAF now protects Blob storage with zero code changes

Vercel Changelog·medium signal

The same deny, challenge, and rate-limit rules that guard Vercel deployments now apply to Blob traffic, evaluated at the edge on IP, country, and path before any data transfer. Enabling it is a dashboard setting — no changes to blob URLs or the `@vercel/blob` library. The OWASP Core Ruleset is unsupported since it targets dynamic apps rather than object delivery, and challenge rules will block server-side requests because they require browser interaction. Free on all plans during beta.