Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

141–150 of 540 posts

Re: Vercel April 2026 security incident

#141

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

If you are using nextjs it is easier because vercel done a lot of things to make it a pain to host outside of vercel.

Re: Vercel April 2026 security incident

#142
post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

The thing I can’t stop thinking about is that Ai is accelerating convergence to the mean (I may be misusing that)

The internet does that but it feels different with this

Re: Vercel April 2026 security incident

#144
post #97

Earlier quoted context omitted.

You use a free template that's done in Next.js and uses its Image component, so you need a server. Everything runs fine locally until you try to deploy it, and bam you need 4g ram machine to run the thing. So you host it on Vercel for free cause it's easy! Then you want to check for more than 30 seconds of analytics, and it's pay time.

I am not following the logic. If you’re a hobbyist, sure. But the argument is if you’re using Vercel for production, you’re paying 5-10x what you’d pay for a VM, with 4gb. So then what’s the rationale? You can’t be a hobbyist but also “it’s pay time” for production?

Perhaps the rationale is laziness. Maintaining VM probably takes some more effort and competence than deploying to Vercel. Some people are willing to pay to minimize effort and the need to learn anything.

Re: Vercel April 2026 security incident

#146

Earlier quoted context omitted.

It's a good point, but I don't think the problem here is Claude. It's how you use it. We need to be guiding developers to not let Claude make decisions for them. It can help guide decisions, but ultimately one must perform the critical thinking to make sure it is the right choice. This is no different than working with any other teammate for that matter.

I think most people would agree. However it is less clear on how to do this, people mostly take the easiest path.

I guess engineers can differentiate their vibecoded projects by selecting an eccentric stack.

Re: Vercel April 2026 security incident

#147
post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

That's the irony of Mythos. It doesn't need to exist. LLM vibe slop has already eroded the security of your average site.

Conspiracy theory: they intentionally seeded the world with millions of slop PRs and now they’re “catching bugs” with Mythos

Re: Vercel April 2026 security incident

#148
post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

10 years ago it was Heroku and Three.js.

Re: Vercel April 2026 security incident

#149
> Vercel did not specify which of its systems were compromised

I’m no security engineer, but this is flatly unacceptable, right? This feels like Vercel is covering its own ass in favor of helping its customers understand the impact of this incident.

Post reply on HN