Skip to content

Review DNS and subdomain configuration for takeover risk #541

Description

@phertyameen

Location

DNS configuration (external to repo, document findings in docs/), vercel.json

Problem

If this project uses any custom domain or subdomain pointing at Vercel (or any other third-party host) via a CNAME, and that record is ever left dangling (e.g. after removing a Vercel project or changing hosting providers) without removing the corresponding DNS entry, the subdomain becomes vulnerable to takeover by an unrelated party who claims the same hosting slug, a classic and easily-overlooked risk for projects with multiple environments (production, staging, docs).

Acceptance Criteria

  • Every DNS record pointing at a third-party-hosted target is inventoried
  • Each is confirmed to point at an actively-owned, non-dangling target
  • A documented process for safely decommissioning a subdomain (removing the DNS record before or immediately after deprovisioning the underlying service) is established for the future

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions