Postgres connections now work through Sandbox firewall
By Steven Van ·
Domain-restricted Vercel Sandboxes can now reach Neon, Supabase, AWS RDS, Nile, and Prisma Postgres without special configuration.
Vercel Sandbox's firewall can now handle connections to hosted Postgres databases, including Neon, Supabase, AWS RDS, Nile, and Prisma Postgres. Adding the database host to a sandbox's allowed domains is enough to enable the connection.
The fix addresses how Postgres negotiates TLS. The Vercel Sandbox firewall normally checks the domain name during a connection's TLS handshake, which works for HTTPS but not for Postgres, since a Postgres client opens a plain TCP connection first and only upgrades to TLS afterward. The firewall now detects that startup sequence, waits for the TLS upgrade, and then applies the domain policy before forwarding the connection. No changes are needed to sandbox code or database configuration, and domain-based rules still require TLS since they depend on the hostname being visible during the handshake. Full details are in the Vercel Sandbox docs.