Building and running websites and apps on Vercel

UAE · India · Global

Every push rebuilds every site? When Turborepo pays off, and three mistakes

By Shivanath DevinarayananPublished 7 min read
Written forHead of digital, IT manager, or founder who owns the company website or web app, signs the hosting bill and answers client security questionnaires“Our site and web app live on an old server, and the security questionnaire is due.”

The short answer

When does Turborepo pay off for a team that keeps several sites or apps in one repository, and what can go wrong?

Turborepo pays off when one repository holds several apps that share code. It builds only what a change touched and shares build results across your team and CI. Declare every environment variable in turbo.json first, or a cached staging build can reach production. At Mindcat, we check that before switching it on.

A row of small glowing site models on a workbench, only one lit gold and being rebuilt while the rest stay dark

Takeaways

  1. 01On Vercel, Turborepo builds only the projects a change affects, so one menu edit does not rebuild every site.
  2. 02Undeclared environment variables can ship your staging build to production. Vercel's docs say so in those words.
  3. 03Turborepo treats logs as artifacts. Anything printed during a build is cached and replayed.
  4. 04The Remote Cache is free on every plan within fair use. Artifacts expire after 7 days.

If your team keeps several sites or apps in one repository and every push rebuilds all of them, this is for you. The fix is a build system plus one file, and the one file is where most teams get it wrong.

Why does one change rebuild every site?

Because nothing tells the build which site the change belongs to. In a repository with a brokerage site, a restaurant site and a shared button library, a typo fix on the restaurant menu starts a build for all three. Each build waits its turn, and each one is a chance for a site nobody touched to change. A typo fix on one client's menu should not put four live sites through a release.

Turborepo is Vercel's answer. Vercel describes it as "a high-performance build system for JavaScript and TypeScript codebases", with incremental builds, content-aware hashing and a Remote Cache. The solutions page says that "when deployed on Vercel, Turborepo only builds affected projects".

Two pieces do the work. In each Vercel project, the Ignored Build Step runs a check, such as turbo query affected or npx turbo-ignore --fallback=HEAD^1, and skips the build when the change did not touch that project. When a build does run, the Remote Cache replays any task whose inputs have not changed, on Vercel and on your own CI.

For how Turborepo runs on Vercel and how it fits with your other systems, see Turborepo on Vercel.

When does Turborepo pay off?

It pays off when one repository holds several apps that share code. That is the shape of most agency repositories and of most companies with a site, a portal and an admin tool.

One repository with four sites: a change to one site rebuilds only that site; a shared package change rebuilds all
What a change rebuilds, from Vercel's Turborepo docs.

Here is the arithmetic, with our assumptions, not a measurement. Four sites, each build three minutes, 20 pushes a day that each touch one site. Without skipping, that is 80 builds and 240 build-minutes a day. With the Ignored Build Step, it is 20 builds and 60 minutes. Three in four builds are skipped. For you that means a fix reaches the live site sooner, and the three sites nobody touched do not change at all.

Our rule: two or more apps with a shared package, or CI runs that redo the same tests on every pull request, and Turborepo earns its place. One app in one repository gains little, because there is nothing to skip. Vercel reports a customer quote from Watershed that Remote Caching "drastically sped up our CI runs". That is Vercel's report, not our measurement.

Which three mistakes ship the wrong thing?

A build cache returns a saved answer instead of rebuilding. That is the speed gain, and it is also the risk: if the cache cannot tell two builds apart, it returns the wrong one. Vercel's docs name all three cases.

Undeclared environment variables. Turborepo decides whether a build is the same by hashing its inputs. If an environment variable changes the output but is not listed in turbo.json, a staging build and a production build look identical. Vercel's docs put it plainly: "you can accidentally ship your staging environment to production". Turborepo tries to infer Next.js public variables on its own; anything else your build inlines must be declared under env or globalEnv.

Logs are artifacts. Vercel warns that "Turborepo treats logs as artifacts, so be aware of what you are printing to the console". A build script that prints an API key stores it in the cache and replays it to anyone who reads that cached log.

Next.js with Skew Protection always misses. Vercel's docs say building a Next.js app that uses Skew Protection "always results in a Turborepo cache miss", because Skew Protection uses an environment variable that changes with each deployment. The other apps in the repository still hit the cache, and the Vercel CDN cache still works. Expect it and do not chase it.

Three mistakes: undeclared variables ship staging to live, logs are cached, Next.js with Skew Protection misses
Three mistakes, each named in Vercel's own docs.

What does the Remote Cache cost, as of 16 October 2026?

Nothing extra, within fair use. Vercel says the Remote Cache "is free for all plans, subject to fair use guidelines", and that you do not need to host on Vercel to use it.

PlanUploads a monthArtifact requests a minute
Hobby (non-commercial only)100 GB100
Pro1 TB10,000
Enterprise4 TB10,000

We are not a Vercel partner and earn nothing from your Vercel bill. Our own site runs on Netlify. What stays portable: Turborepo runs with a local cache and no Vercel account. What is Vercel's: the Remote Cache and the Ignored Build Step setting in each project.

Artifacts expire after 7 days, so a branch nobody touched for two weeks builds from scratch once. Enterprise adds signed artifacts that are verified before use. In one line: the cache is free, and the bill is USD 20 a month for each deploying seat plus metered usage. For one marketing site and one portal with normal traffic, that usage usually sits inside the included USD 20 credit; our arithmetic for a similar site is in our Next.js post. The cost you do pay is the hosting plan and the seats: on Pro, USD 20 a month with one deploying seat and USD 20 of usage credit, and USD 20 for each extra deploying seat.

What does this look like for a digital agency?

Take a sample Dubai digital agency with four client sites in one repository, a brokerage, a restaurant group, a clinic and a hotel apartments group, plus one shared package of buttons and forms. This is an illustration, not a client story.

  1. 01Each client site is its own Vercel project, pointing at its folder in the repository, with turbo-ignore as the Ignored Build Step.
  2. 02A designer changes the restaurant menu page. Only the restaurant site builds. The other three show as skipped.
  3. 03A developer changes the shared form component. All four sites build, because all four use it.
  4. 04Each site's form keys and API addresses are listed under env in turbo.json, so a staging build never stands in for a live one.
  5. 05The agency's GitHub Actions use the same Remote Cache, so a test run whose inputs have not changed is replayed instead of run again.
A digital agency example: four client sites and a shared package in one repository, each build only when touched
A worked example for a digital agency. Illustrative, not a client story.

One question to settle early: whose Vercel team holds each client's site, because the team owner pays the bill and decides who can deploy. See how we work with digital agencies.

What goes on the security questionnaire?

Vercel splits the answers in its shared responsibility model, read on 16 October 2026. Here is who writes each line.

Questionnaire lineWho answers it
Platform certificationsVercel. It holds a SOC 2 Type 2 attestation and ISO 27001:2022; reports are at security.vercel.com. They cover Vercel's platform, so request them from Vercel
Network, infrastructure, encryption in transit and at restVercel, for the services it runs
Where data is processedYou. You pick the function region. None is in the UAE or Saudi Arabia; Mumbai (bom1) is the nearest. Your database is wherever you put it
Logins, keys and source codeYou. Vercel holds environment variables; who can read them is your team setting
Logs kept long termYou, through a log drain. Vercel keeps short-term runtime logs
Cost of bad trafficYou. Vercel's model says the customer pays for malicious traffic, so set a spend limit

If a contract says data must be processed inside the UAE, Vercel cannot meet it today. Say so before you sign, not after.

For a bad month, set Spend Management. Vercel sends alerts at 50%, 75% and 100% of the amount you set, and pauses production when you reach it if Pause Production Deployments is on. A budget alone does not stop usage, and the check can lag by several minutes. If a change breaks the site, Instant Rollback on Pro returns production to any earlier production deployment from the dashboard; environment variable changes are not rolled back with it. One gap: the Remote Cache docs we read do not say which region holds cached build artifacts. Ask Vercel in writing if a questionnaire asks, and keep keys out of build logs either way.

What do you check before you switch it on?

  1. 01Every environment variable that changes a build is listed in turbo.json, per app or under globalEnv.
  2. 02No build script prints a key, a token or a customer record.
  3. 03Each Vercel project has an Ignored Build Step that checks whether its app was affected.
  4. 04turbo login and turbo link are done for CI, against the right Vercel team.
  5. 05The team knows a Next.js app with Skew Protection will always rebuild, and why.
  6. 06One test: change one app, push, and confirm the others are skipped.

If your repository holds one app and the build takes two minutes, you do not need Turborepo yet; come back when the second app arrives.

What happens on the first call?

We call the method Preview every change: each change gets its own preview link, someone on your side approves it on a phone, then it goes live, and any release can be rolled back. Send us the repository and how your builds run today. The written assessment is free and says what to change, what to keep and what it costs to run. The first build week is a fixed AED/SAR 14,900, and a Run plan keeps the builds and sites running afterwards. More on how we build and run sites is on our Vercel page.

Filed under

Building and running websites and apps on Vercelvercel remote cacheturborepo monorepoturbo-ignoremonorepo build time
Useful to someone on your team?

FAQ

Questions teams ask next

What is Turborepo?
Vercel describes Turborepo as a high-performance build system for JavaScript and TypeScript codebases. It runs builds incrementally, hashes content to know what changed, and can share results through a Remote Cache. On Vercel, it builds only the projects affected by a change.
Do I have to host on Vercel to use the Remote Cache?
No. Vercel's docs say you do not need to host your project on Vercel to use Vercel Remote Caching. It works from external CI such as GitHub Actions and CircleCI. You log in with turbo login and link the repository with turbo link.
How much does Vercel's Remote Cache cost?
Vercel says the Remote Cache is free for all plans, subject to fair use. As of 16 October 2026 that is 100 GB of uploads a month on Hobby, 1 TB on Pro and 4 TB on Enterprise, with artifacts kept for 7 days. Hobby itself is for non-commercial use only.
Why does my Next.js app never hit the Turborepo cache on Vercel?
If the app uses Skew Protection, Vercel's docs say building it always results in a Turborepo cache miss, because Skew Protection uses an environment variable that changes with each deployment. You can still get cache hits from the Vercel CDN. Other apps in the same repository keep their Turborepo cache hits.

Sources

  1. 01Vercel docs: Deploying Turborepo to VercelAccessed 16 Oct 2026
  2. 02Vercel docs: Remote Caching (fair use and expiry)Accessed 16 Oct 2026
  3. 03Vercel: Turborepo solutions pageAccessed 16 Oct 2026
  4. 04Vercel docs: Hobby planAccessed 16 Oct 2026
Shivanath Devinarayanan, founder of Mindcat

Written by

Shivanath Devinarayanan

Founder, Mindcat Consulting · Salesforce MVP Hall of Fame

Runs 200+ agents in production. Reads every brief that comes in and signs the work that goes out.

About Shivanath

Build It, Preview It, Run It · the written assessment

We work in real estate and right now, leads go cold before anyone replies.

Industry
Problem

Brief: Real estate. Leads from portals and WhatsApp. Follow-up has no owner. An agent on a named process. A reviewer on the exceptions. From: /blog/turborepo-remote-cache-agency-monorepo.