Vercel Access Token

Detects Vercel credentials: the current prefixed token family introduced in February 2026 (vcp_ personal access tokens, vci_ integration tokens, vca_ app access tokens, vcr_ app refresh tokens, vck_ API keys), Vercel Blob read-write tokens (vercel_blob_rw_), and, when labelled with Vercel context in an assignment, the legacy unprefixed 24-character token form. A leaked token grants control of the account's projects, deployments and environment variables; a leaked Blob token grants read/write access to the associated storage.

Type: regex
Engine: universal
Confidence: high
Confidence justification: High confidence: the vc?-prefix family is documented by Vercel's own changelog (all five prefixes named, introduced specifically so scanners can detect them), corroborated by literal vca_/vcr_ token examples in Vercel's own Sign in with Vercel docs (56-character alphanumeric bodies), and Vercel is a GitHub secret-scanning partner with six token types, five push-protection enabled. Exact per-prefix body lengths are not formally published, so an honest bounded 40-80 range is used. The legacy unprefixed form is deliberately context-gated: it is indistinguishable from other 24-character identifiers (GitGuardian lists it as non-prefixed), so it requires a labelled assignment and never fires value-only.
Jurisdictions: global
Regulations: Criminal Code Act 1995 (Cth)
Frameworks: CIS Controls, ISO 27001, NIST CSF, SOC 2
Data categories: credentials, security
Scope: narrow
Risk rating: 8
Platform compatibility: Purview: Compatible, GCP DLP: Unsupported, Macie: Unsupported, Zscaler: Compatible, Palo Alto: Unsupported, Netskope: Unsupported

Pattern

(?<![A-Za-z0-9_])(?:vc[aikpr]_[A-Za-z0-9]{40,80}|vercel_blob_rw_[A-Za-z0-9]{5,40}_[A-Za-z0-9]{10,60})(?![A-Za-z0-9_])

Corroborative evidence keywords

vercel, vercel.com, VERCEL_TOKEN, deployment, api key, api_key, apikey, access key, access token, auth token, authorization, bearer, conn str, connection string, connectionstring, cookie, credential, database, host, [object Object] (+37 more)

Proximity: 300 characters

Should match

VERCEL_TOKEN=vcp_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567 — Vercel personal access token, current vcp_ format, in the canonical env var
vca_zyxwvutsrqponmlkjihgfedcbaZYXWVUTSRQPONMLKJIHGFEDCBA9876 — Vercel app access token (vca_ + 56-char body, the length shown in Vercel's own docs example)
vck_0123456789ABCDEFGHIJ0123456789abcdefghij — Vercel API key (vck_ prefix, 40-char body at the bounded floor)
BLOB_READ_WRITE_TOKEN=vercel_blob_rw_abc123_ABCDEFGHIJKLMNOPQRSTUVWXYZ — Vercel Blob read-write token (vercel_blob_rw_ + store id + secret)
vercel_blob_rw_store01_zyxwvutsrqponmlkjihgfedcba0123456789 — Bare Vercel Blob token (distinctive prefix, no label needed)
VERCEL_TOKEN=ABCDEFGHIJKLMNOPQRSTUVWX — Legacy unprefixed Vercel token (24 chars) in a labelled assignment
vercel api token: zyxwvutsrqponmlkjihgfedc — Legacy Vercel token with a label and colon separator within the proximity gap

Should not match

vercel_deploy_id_ABCDEFGHIJKLMNOPQRSTUVWX_env_more — 24-char run glued inside a longer identifier (boundary regression case from review)
vcx_ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz01234567 — Invalid prefix letter (vcx_ is not a Vercel token family)
vcp_ABCDEFGHIJ0123456789 — vcp_ body too short (20 chars, below the 40-char floor)
ABCDEFGHIJKLMNOPQRSTUVWX with no vendor context — Bare 24-char alphanumeric value with no Vercel label anywhere (could be any ID or hash)
vercel_blob_rw_abc_Zz9 — Blob token secret segment far too short (3 chars, below the 10-char floor)
rotate the vercel token in account settings — Prose mention without a token value
template example placeholder record identifier — Template/sample context should be excluded even when anchor words are present

Known false positives

A 24-character identifier (for example a MongoDB ObjectId is 24 hex characters) appearing in a labelled assignment near the word "vercel" in configuration or logs. Mitigation: The legacy branch requires label adjacency plus an assignment separator (already enforced by the regex) and corroborative keywords; it is context-gated only and never fires value-only.
Documentation or examples showing placeholder vcp_/VERCEL_TOKEN/vercel_blob_rw_ strings. Mitigation: Check for placeholder markers (example, xxxx, 0000) and documentation file types to reduce false positives.
The per-prefix body lengths of the vc?-family are not individually published; a bounded 40-80 range around the vendor-documented 56-character examples is used, and the possible sixth partner type (support access tokens) has no published prefix and is not matched. Mitigation: Documented as an honest bound; the prefixes themselves are vendor-announced and highly distinctive.