Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

171–180 of 540 posts

Re: Vercel April 2026 security incident

#171

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

If you are using nextjs it is easier because vercel done a lot of things to make it a pain to host outside of vercel.

Do you have any examples?. I'm not that acquainted with the pains of deploying Next apps, though I've heard that argument being used.

Re: Vercel April 2026 security incident

#172

Earlier quoted context omitted.

I am not following the logic. If you’re a hobbyist, sure. But the argument is if you’re using Vercel for production, you’re paying 5-10x what you’d pay for a VM, with 4gb. So then what’s the rationale? You can’t be a hobbyist but also “it’s pay time” for production?

Perhaps the rationale is laziness. Maintaining VM probably takes some more effort and competence than deploying to Vercel. Some people are willing to pay to minimize effort and the need to learn anything.

Vercel auto creates deployments on pushes to branches. That was a super useful feature in beta testing web stuff.

Re: Vercel April 2026 security incident

#173

Earlier quoted context omitted.

He doesn't work at Vercel but he is the type to never pass up any opportunity to chase clout.

Almost like that’s his job. Hey, I’m with you - I think social media needs to die specifically for this reason. I’m reminded of the term “snake oil” - it’s like the dawn of newspapers again.

Media as a whole needs to die

Re: Vercel April 2026 security incident

#175
post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies.

So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that.

[1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vibe coding

Re: Vercel April 2026 security incident

#176

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

Can one host a Next js app on cloudflare?

Maybe. CF’s runtime isn’t perfectly identical to Vercel’s. For instance, CF doesn’t support eval(), which is something you shouldn’t be doing often anyway, but it did mean that we can’t use the NPM protobufs package that’s a dependency for some Google SDKs.

Re: Vercel April 2026 security incident

#178
post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

It's a good point, but I don't think the problem here is Claude. It's how you use it. We need to be guiding developers to not let Claude make decisions for them. It can help guide decisions, but ultimately one must perform the critical thinking to make sure it is the right choice. This is no different than working with any other teammate for that matter.

No, the problem is the people building and selling these tools. They are marketed as a way of outsourcing thinking.

Re: Vercel April 2026 security incident

#180
They just added more details:

> Indicators of compromise (IOCs)

> Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations.

> We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicious activity in their environments. We recommend that Google Workspace Administrators and Google Account owners check for usage of this app immediately.

> OAuth App: 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com

https://vercel.com/kb/bulletin/vercel-april-2026-security-in...

Post reply on HN