Vercel April 2026 security incident

Post by siva7 » Sun, Apr 19, 2026, 7:48 PM UTC

neilv wrote: post #175

nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

Post by Onavo » Sun, Apr 19, 2026, 7:50 PM UTC

fontain wrote: post #170

tucnak wrote: post #136

Earlier quoted context omitted.

All of this is available in Cloudflare $5 plan?

Cloudflare’s developer experience doesn’t come close, it is terrible. Cloudflare are working on it, and hopefully they’ll be a real competitor to Vercel on ease of use someday, but right now, it is painful when compared to Vercel. Cloudflare is infrastructure first, Vercel is developer experience first.

Post by politelemon » Sun, Apr 19, 2026, 7:51 PM UTC

Aurornis wrote: post #189

operatingthetan wrote: post #125

Earlier quoted context omitted.

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

Reddit vibecoded LLM posts are kind of fascinating for how homogenous they are. The number of vibe coded half-finished projects posted to common subreddits daily is crazy high. It’s interesting how they all use LLMs to write their Reddit posts, too. Some of them could have drawn in some people if they took 5 minutes to type an announcement post in their own words, but they all have the same LLM style announcement pos…

Post by progbits » Sun, Apr 19, 2026, 7:52 PM UTC

loloquwowndueo wrote: post #193

nettlin wrote: post #180

They just added more details: > Indicators of compromise (IOCs) > Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations. > We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicio…

The actual app name would be good to have. Understandable they don’t want to throw them under the bus but it’s just delaying taking action by not revealing what app/service this was.

Post by drewnick » Sun, Apr 19, 2026, 7:54 PM UTC

kandros wrote: post #137

zuzululu wrote: post #86

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

For many people Vercel is Easy (not simple) Knowing how to operate a basic server is perceived as hard and dangerous by many, especially the generation that didn’t have a chance to play with Linux for fun when growing up