Vercel has added a natural-language layer to its Firewall custom rules, giving developers a faster way to build WAF policies without manually assembling every condition first.

What changed

In a May 12 changelog entry, Vercel said users can now describe a rule in plain English and have the platform generate the configuration. The examples are concrete rather than vague: rate-limit /api, block requests for .env or .git files, or challenge suspicious traffic headed to a checkout flow.

The supporting docs show that the generated rule still maps onto Vercel's existing WAF actions and conditions. Developers can review or edit the output before saving, and the same rule system can log, deny, challenge, bypass, redirect, or rate-limit traffic based on inputs such as path, country, headers, method, or user agent. Vercel's CLI docs also now document an interactive vercel firewall rules add --ai flow for creating rules from a prompt in the terminal.

Why it matters

This is not a new security primitive. It is an interface change on top of Vercel's existing firewall controls. But that still matters for small teams, because writing precise traffic rules is often tedious enough that useful protections get postponed.

The conservative takeaway is that Vercel is trying to make WAF policy feel more like developer tooling than specialist security configuration. If the generated rules are accurate in practice, that could lower the friction for shipping basic protections earlier in an application's lifecycle.