Vercel preview external-sharing boundary — Hovvi
Vercel documents how external preview review separates a moving branch from a fixed commit, a reviewer invitation from team membership, and preview access from production release.
Published by Hovvi Research. Observed ; materially updated .
What happened
Choose whether feedback targets an evolving branch or a fixed commit first, then choose the narrowest documented reviewer access path and make the production-release boundary explicit rather than letting a URL imply it. Make the preview version, review audience and feedback/access route legible before a build is shared outside the team.
Evidence
The review link must say whether the build will move underneath the reviewer.
| Review need | Documented route | Decision constraint |
|---|---|---|
| Frozen acceptance check | Commit link | Points to one specific commit rather than the branch's latest commit |
| Iterating feedback | Branch link | Tracks the latest commit on its branch |
| Named external reviewer | Individual invitation | Does not make that person a Vercel team member and can be revoked |
A preview link, a login requirement and a public release are separate decisions.
| Access path | Documented consequence | Do not infer |
|---|---|---|
| Individual invite | Named reviewer can be granted and later revoked | That the reviewer joined the team |
| Anyone with protected link | A shareable link can bypass deployment protection for its holder | That the build became an unrestricted public production release |
| Request Access | Owner can allow or deny a reviewer who lacks comment access | That access has already been granted |
External review access is evidence collection, not proof of a production release.
The documented share controls decide who may open or comment on a preview. They do not establish production routing, acceptance, uptime, release approval or a completed feedback loop.
Observed facts
- Vercel documents three external-preview access paths: invite an individual, use an access setting that allows anyone or anyone with a link according to deployment protection, or approve an access request; external collaborators are not added to the Vercel team.
- A Vercel branch link reflects the latest commit on that branch, while a commit link is tied to one specific commit; the Share dialog defaults to the branch link and can switch to the commit link.
- For individual preview invitations, protected viewing or commenting requires the reviewer to log in, and the owner can revoke the invitation in the Share dialog. Pro and Enterprise can add multiple external collaborators; Hobby allows one at a time.
- The Share dialog distinguishes team members with access, anyone without deployment protection, and anyone with a protected link; the protected-link option creates a shareable link that bypasses deployment protection for the link holder and lets that visitor use Toolbar and comments after login.
- A visitor without comment access sees Request Access; the deployment owner receives a notification and can allow or deny the request from the Share dialog's Access Requests section.
- Vercel Authentication restricts public and non-public deployment viewing and commenting to people who have deployment access, sending others to a Vercel login page before redirecting them back to the deployment.
Editorial inference
- Making preview identity visible before access selection reduces the risk that an external reviewer evaluates a later build than the one a team intends to accept.
- A product can make external feedback safer without equating a shareable preview URL with public launch by keeping access scope, feedback permission and release state as separate visible concepts.
Evidence views
- Preview identity showing branch or fixed commit
- External-review access selection
- Individual invitation with revocation state
- Access-request pending, allowed and denied states
- Deployment-protection explanation that separates preview from public release
Founder takeaway
Before sharing a pre-production build, state which version the reviewer will see, give the narrowest access path and never let a preview link stand in for a release claim.
Use when
- A pre-production product or prototype needs feedback from an external stakeholder
- Reviewers must know whether the evidence they see can change with a later commit
- The product distinguishes named reviewer access from permanent membership
- Owners need an explicit request, approval and revocation vocabulary
Avoid when
- The product has no preview or staged-release concept
- A regulated release requires a formal approval trail not documented by this reference
- A public marketing demo is the intended evaluation surface rather than a specific pre-production build
Next implementation step
Design an external-preview review path that makes version identity, access scope, review permission and the production boundary explicit before feedback begins.
Acceptance criteria
- A sharer can state whether feedback targets a fixed commit or an evolving branch before copying a link
- A reviewer can tell whether access is an invitation, a protected-link path or a request awaiting owner action
- A revoke control and its scope are visible without claiming inherited permissions that the source does not document
- The surface labels a preview as pre-production and does not imply release acceptance or public availability
- No reference artifact contains a protected URL, token, account state or third-party product media
Related cases
- External review access with different scopes: Figma sharing access guardrails pattern — Hovvi
Vercel distinguishes an evolving branch preview from a fixed commit and scopes an external review path without adding the reviewer to a team, while Figma scopes a content-sharing audience and its view-or-edit capability. Both need explicit grant and revocation boundaries, but their objects and feedback permissions are not interchangeable.
- Protected review versus public sample proof: Grafana public trace evaluation for API prototypes — Hovvi
Grafana offers a public sample environment before private telemetry setup, while Vercel documents an owner-scoped preview for a named or link-enabled external reviewer. Both support evaluation before commitment, but public product proof must not be confused with access to a specific protected build.
Version history
Current snapshot: snap_vercel_preview_sharing_2026_09_01 — Added a bounded Vercel Task Reference using official link-only documentation to distinguish preview identity, reviewer access and release boundaries; no Vercel product media, protected URL, account state or observed sharing execution is retained.
Use with an Agent
Example read-only MCP query:
Retrieve the Hovvi Founder case fc_vercel_preview_external_sharing_2026_09 with observed facts, evidence screens, applicability limits and citations.