Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

121–130 of 540 posts

Re: Vercel April 2026 security incident

#121

Earlier quoted context omitted.

0.82% of homes are burglarized every year. Meaning since 2015, you’ve got an 8.2% chance of having someone walk out with that box. Hopefully there’s nothing precious on it.

yes, this is indeed how probability works. thanks.

>you’ve got an 8.2% chance of having someone walk out with that box.

The chance of being burglarized is not the same as the chance that when you are hit, they decide to take your webserver. Think it through.

Re: Vercel April 2026 security incident

#122
post #48

Earlier quoted context omitted.

Isn’t he a Vercel evangelist though?

He is "whatever gives me short-term boost in popularity". Including doing 180 turns on whatever he's evangelizing or bashing.

Let's see. Roasting vercel is more popular than defending but his posts so far he seems to be defending and arguing in the replies.

Re: Vercel April 2026 security incident

#123

Earlier quoted context omitted.

0.82% of homes are burglarized every year. Meaning since 2015, you’ve got an 8.2% chance of having someone walk out with that box. Hopefully there’s nothing precious on it.

That’s not how probabilities work.

Or burglars.

Re: Vercel April 2026 security incident

#125
post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

Re: Vercel April 2026 security incident

#126
post #82

I've been part of a response team on a security incident and I really feel for them. However, this initial communication is terrible. Something happened, we won't say what, but it was severe enough to notify law enforcement. What floors me is the only actionable advice is to "review environment variables". What should a customer even do with that advice? Make sure the variable are still there? How would you know if a…

> The only reason to dramatically overpay for the hosting resources they provide is because you expect them to expertly manage security and stability. This and because it's so convenient to click some buttons and have your application running. I've stopped being lazy, though. Moved everything from Render to linode. I was paying render $50+/month. Now I'm paying $3-5. I would never use one of those hosting providers a…

Looking at linode, those prices get you an instance with 1Gb of ram and a mediocre CPU. So you are running all of your applications on that?

Re: Vercel April 2026 security incident

#127

I've been part of a response team on a security incident and I really feel for them. However, this initial communication is terrible. Something happened, we won't say what, but it was severe enough to notify law enforcement. What floors me is the only actionable advice is to "review environment variables". What should a customer even do with that advice? Make sure the variable are still there? How would you know if a…

Completely agreed. At minimum they should be advising secret rotation.

The only possibility for that not being a reasonable starting point is if they think the malicious actors still have access and will just exfiltrate rotated secrets as well. Otherwise this is deflection in an attempt to salvage credibility.

Re: Vercel April 2026 security incident

#128

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

0.82% of homes are burglarized every year. Meaning since 2015, you’ve got an 8.2% chance of having someone walk out with that box. Hopefully there’s nothing precious on it.

I definitely do not keep it at home but the thought has crossed me for smaller less demanding boxes.

Re: Vercel April 2026 security incident

#129
post #105

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

They put a massive amount of VC cash into convincing people that Next.js was "the modern way" to create a website. Then they got lucky with the timing of LLMs becoming popular while they were the hot thing, leading LLMs to default to it when creating new websites. To picture that amount of VC cash - they're at Series F , and a huge chunk of that went towards marketing. Both have been changing as people realize it's r…

I really want this to be true. nextjs is a nightmare. I'm eternally disgruntled.

nextjs is also powerful due to AI. But the value is a robust interactive front-end, easily iterated, with maybe SSR backing, nothing specific to nextjs (it's routing semantics + React).

So much complexity has gone into SSR. I hate 5MB client runtime just to read text as much as anyone, but not if the tradeoff is isomorphic env with magic file first-line incantations.

Re: Vercel April 2026 security incident

#130
post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

That's the irony of Mythos. It doesn't need to exist. LLM vibe slop has already eroded the security of your average site.
Post reply on HN