Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-07-25 · high
Enabling it takes one dashboard toggle and doesn't touch a single blob URL or a line of client code.
Why now: The feature is still in beta and free on every plan, which is the window worth testing it in before that changes.
Vercel extended its Web Application Firewall to cover Blob storage traffic, per the company's changelog. For anyone running Blob in production, that's a security upgrade that doesn't require touching the @vercel/blob library or rewriting a single URL. It's a dashboard setting, not a migration project.
The same deny, challenge, and rate-limit rules that protect app requests now apply to Blob traffic too. Vercel evaluates them at the edge, checking IP, country, and path before any object transfer happens.
Two real limits to know before you flip it on. The OWASP Core Ruleset isn't supported here. It's built to catch attacks against dynamic application logic, not static object delivery, so it doesn't map onto Blob traffic.
Challenge rules are the other one. They require browser interaction, so they'll block legitimate server-side requests outright. A server can't complete that interaction, so skip challenge rules on any path with non-browser callers.
It's free on all plans during the beta, so testing it against a staging bucket costs nothing but time. Turn on deny and rate-limit rules now. Hold off on challenge rules until you've mapped every non-browser caller hitting your blob URLs.
Each link below shares sources, entities, or timing with this story.
Shared entity: Free / Same source domain / Shared topic / Earlier coverage / Tension
Both cover Free; reported by the same outlet (vercel.com); overlapping topics (chang, code, deployment).
Shared entity: Free / Shared topic / Earlier coverage
Both cover Free; overlapping topics (browser, chang); earlier Free coverage from 2026-07-10.
Both cover Free; overlapping topics (code, vercel); earlier Free coverage from 2026-04-05.
Both cover Free; overlapping topics (apps, beta); earlier Free coverage from 2026-03-04.
Both cover Free; overlapping topics (block, data); earlier Free coverage from 2026-02-26.
Shared entity: Enabling / Earlier coverage / Tension
Both cover Enabling; earlier Enabling coverage from 2026-07-18; pushes against this story (versus).
Shared entity: Free / Earlier coverage / Tension
Both cover Free; earlier Free coverage from 2026-03-10; pushes against this story (against).
Shared topic / Tension
Overlapping topics (apps, code, vercel); pushes against this story (but).