Full Sandbox egress firewall now available on Hobby plan

Vercel has expanded its Sandbox firewall feature set to the free Hobby plan. Hobby users now get full access to egress network policies, credentials brokering, request proxying, and fine-grained request matchers. The firewall attaches secrets to outbound requests automatically, so sandboxed code can call authenticated services like Vercel AI Gateway without exposing tokens. Policies can be defined as allow-all, deny-all, or custom domain/IP-based rules scoped by path, method, query string, or headers. The Sandbox CLI also supports live policy updates without restarting the sandbox, reducing data exfiltration risk when running untrusted or AI-generated code.