Full Sandbox egress firewall now available on Hobby plan
Vercel brings production-grade sandbox isolation to free tier—critical for running untrusted AI code safely.
Why it matters
Sandbox egress firewalls are now table stakes for any platform running AI-generated or third-party code. This feature moving to Hobby tier (free) lowers the barrier for practitioners shipping agents and code-generation tools without exposing secrets or allowing exfiltration.
The key facts
11 to knowSandbox egress firewall now available on Vercel Hobby (free) plan
Network policies support domain and IP-based rules with path, method, query string, and header matchers
Sandbox CLI manages policies live without restart
Firewall attaches secrets to outbound requests, preventing code from ever seeing tokens
Reduces data exfiltration risk for untrusted and AI-generated code
Production-grade isolation brought to free tier
Sandbox egress firewall now available on free Hobby plan (previously paid-only)
Firewall attaches secrets to outbound requests—code never sees tokens
Supports allow-all, deny-all, or custom domain/IP-based policies with path, method, query, header matchers
Live policy updates via Sandbox CLI without restart
Designed to reduce data exfiltration risk when running untrusted or AI-generated code
Go to the source
Vercel Blogvercel.com
Publisher excerpt: All firewall features are now available on the Hobby plan.Vercel Sandbox This brings the same network isolation that protects production workloads to the free tier, giving Hobby builders control over exactly what leaves the sandbox while keeping secrets out of the code entirely. Because the…