Get this on every PR automatically. Webhook fires, AI reviews, you approve.
Install on vercel/wait-for-deployment-action →
// reviewed by pulllight
PullLight found 3 issues
1 high
2 medium
// convert to your repo
PullLight caught 3 1 high, 2 medium on this PR.
Install on vercel/wait-for-deployment-action to get this on every PR automatically — 60 seconds.
Findings
3 issues
medium
logic
When `vercelToken` is set but `statusContext` is empty, the `source` is built as `{ type: 'vercel', ... }` but the entire ID-resolution block is skipped because of the `if (config.statusContext)` guard on line 151. This means the Vercel token path is silently bypassed whenever `status-context` is cleared. The Vercel path should not depend on `statusContext` being truthy — it should have its own independent guard (`if (config.vercelToken)`).
// src/run.ts:151
high
error-handling
`assert` from `node:assert/strict` throws an `AssertionError` (not a regular `Error`) when `response.ok` is false. The error message only includes the status code but not the response body, making it impossible to diagnose Vercel API errors (e.g. invalid token, rate limit). More critically, the `assert` call will throw before `response.json()` is called, so the error body is never consumed — but the real issue is that callers catching a generic `Error` may not handle `AssertionError` correctly in all environments. Consider using a conditional throw with a descriptive error that includes the response body.
// src/vercel.ts:23
⚡ Suggested fix
if (!response.ok) {
const body = await response.text().catch(() => '');
throw new Error(
`Vercel API returned ${response.status} for ${hostname}${body ? `: ${body}` : ''}`,
);
}
medium
auth
The Vercel token (`source.token`) is passed in the `Authorization` header. If `deploymentUrl` is attacker-controlled or malformed in a way that causes the `new URL()` call to succeed but resolve to an unexpected host, the Bearer token would be sent to that host. The function should validate that `deploymentUrl` is a `vercel.app` or known Vercel domain before making the API call.
// src/vercel.ts:14