Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

181–190 of 540 posts

Re: Vercel April 2026 security incident

#181

Post by nettlin »

They just added more details:

> Indicators of compromise (IOCs)

> Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations.

> We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicious activity in their environments. We recommend that Google Workspace Administrators and Google Account owners check for usage of this app immediately.

> OAuth App: 110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com

https://vercel.com/kb/bulletin/vercel-april-2026-security-in...

Re: Vercel April 2026 security incident

#182

Post by echelon »

neilv wrote: post #175
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

It emits Actix and Axum extremely well with solid support for fully AOT type checked Sqlx.

Switch to vibe coding Rust backends and freeze your supply chain.

Super strong types. Immaculate error handling. Clear and easy to read code. Rock solid performance. Minimal dependencies.

Vibe code Rust for web work. You don't even need to know Rust. You'll osmose it over a few months using it. It's not hard at all. The "Rust is hard" memes are bullshit, and the "difficult to refactor" was (1) never true and (2) not even applicable with tools like Claude Code.

Edit: people hate this (-3), but it's where the alpha is. Don't blindly dismiss this. Serializing business logic to Rust is a smart move. The language is very clean, easy to read, handles errors in a first class fashion, and fast. If the code compiles, then 50% of your error classes are already dealt with.

Python, Typescript, and Go are less satisfactory on one or more of these dimensions. If you generate code, generate Rust.

Re: Vercel April 2026 security incident

#183

Post by dennisy »

duped wrote: post #178
nightski wrote: post #118

Earlier quoted context omitted.

It's a good point, but I don't think the problem here is Claude. It's how you use it. We need to be guiding developers to not let Claude make decisions for them. It can help guide decisions, but ultimately one must perform the critical thinking to make sure it is the right choice. This is no different than working with any other teammate for that matter.

No, the problem is the people building and selling these tools. They are marketed as a way of outsourcing thinking.

So what are you suggesting do not allow companies to sell such tools?

Re: Vercel April 2026 security incident

#184

Post by elric »

nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

Interstingly, a recent conversation [1] between Hank Green and security researcher Sherri Davidoff argued the opposite. More GenAI generated code targeted at specific audiences should result in a more resilient ecosystem because of greater diversity. That obviously can't work if they end up using the same 3 frameworks in every application.

[1] https://www.youtube.com/watch?v=V6pgZKVcKpw

Re: Vercel April 2026 security incident

#185

Post by echelon »

operatingthetan wrote: post #125
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

Another Anthropic revenue stream:

Protection money from Vercel.

"Pay us 10% of revenue or we switch to generating Netlify code."

Re: Vercel April 2026 security incident

#186

Post by neilv »

echelon wrote: post #182
neilv wrote: post #175

Earlier quoted context omitted.

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

It emits Actix and Axum extremely well with solid support for fully AOT type checked Sqlx. Switch to vibe coding Rust backends and freeze your supply chain. Super strong types. Immaculate error handling. Clear and easy to read code. Rock solid performance. Minimal dependencies. Vibe code Rust for web work. You don't even need to know Rust. You'll osmose it over a few months using it. It's not hard at all. The "Rust i…

How are you getting low dependencies for Web backend with Rust? (All my manually-written Rust programs that use crates at all end up pulling in a large pile of transitive dependencies.)

Re: Vercel April 2026 security incident

#187

Post by mentalgear »

themafia wrote: post #152
neal_jones wrote: post #142

Earlier quoted context omitted.

The thing I can’t stop thinking about is that Ai is accelerating convergence to the mean (I may be misusing that) The internet does that but it feels different with this

> convergence to the mean That's a funny way of saying "race to the bottom." > The internet does that but it feels different with this How does "the internet do that?" What force on the internet naturally brings about mediocrity? Or have we confused rapacious and monopolistic corporations with the internet at large?

Indeed 'race to the bottom' seems more like capitalism in general.

Re: Vercel April 2026 security incident

#188

Post by OptionOfT »

echelon wrote: post #182
neilv wrote: post #175

Earlier quoted context omitted.

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

It emits Actix and Axum extremely well with solid support for fully AOT type checked Sqlx. Switch to vibe coding Rust backends and freeze your supply chain. Super strong types. Immaculate error handling. Clear and easy to read code. Rock solid performance. Minimal dependencies. Vibe code Rust for web work. You don't even need to know Rust. You'll osmose it over a few months using it. It's not hard at all. The "Rust i…

Except with using Rust like this you're using it like C#. You don't get to enjoy the type system to express your invariants.

Re: Vercel April 2026 security incident

#189

Post by Aurornis »

operatingthetan wrote: post #125
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

Reddit vibecoded LLM posts are kind of fascinating for how homogenous they are. The number of vibe coded half-finished projects posted to common subreddits daily is crazy high.

It’s interesting how they all use LLMs to write their Reddit posts, too. Some of them could have drawn in some people if they took 5 minutes to type an announcement post in their own words, but they all have the same LLM style announcement post, too. I wonder if they’re conversing with the LLM and it told them to post it to Reddit for traction?

Re: Vercel April 2026 security incident

#190

Post by mvkel »

nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

That's only looking at half of the equation.

That lack of diversity also makes patches more universal, and the surface area more limited.

Post reply on HN