Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

221–230 of 540 posts

Re: Vercel April 2026 security incident

#221

Post by lijok »

slopinthebag wrote: post #218
nettlin wrote: post #180

They just added more details: > Indicators of compromise (IOCs) > Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations. > We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicio…

Idk exactly how to articulate my thoughts here, perhaps someone can chime in and help. This feels like a natural consequence of the direction web development has been going for the last decade, where it's normalised to wire up many third party solutions together rather than building from more stable foundations. So many moving parts, so many potential points of failure, and as this incident has shown, you are only as…

This isn't a web development concept. It's the unix philosophy of "write programs that do one thing and do it well" and interconnect them, being taken to the extremes that were never intended.

We need a different hosting model.

Re: Vercel April 2026 security incident

#222

Post by t0mas88 »

neilv wrote: post #175
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

You can tell Claude to use something highly structured like Spring Boot / Java. It's a bit more verbose in code, but the documentation is very good which makes Claude use it well. And the strict nature of Java is nice in keeping Claude on track and finding bugs early.

I've heard others had similar results with .NET/C#

Re: Vercel April 2026 security incident

#223

Post by raw_anon_1111 »

Why does anyone running a third party tool have access to all of their clients’ accounts? I can’t imagine something this stupid happening with a real service provider.

I see Vercel is hosted on AWS? Are they hosting every one on a single AWS account with no tenant isolating? Something this dumb could never happen on a real AWS account. Yes I know the internal controls that AWS has (former employee).

Anyone who is hosting a real business on Vercel should have known better.

I have used v0 to build a few admin sites. But I downloaded the artifacts, put in a Docker container and hosted everything in Lambda myself where I controlled the tenant isolation via separate AWS accounts, secrets in Secret Manager and tightly scoped IAM roles, etc.

Re: Vercel April 2026 security incident

#225

Post by slopinthebag »

lijok wrote: post #221
slopinthebag wrote: post #218

Earlier quoted context omitted.

Idk exactly how to articulate my thoughts here, perhaps someone can chime in and help. This feels like a natural consequence of the direction web development has been going for the last decade, where it's normalised to wire up many third party solutions together rather than building from more stable foundations. So many moving parts, so many potential points of failure, and as this incident has shown, you are only as…

This isn't a web development concept. It's the unix philosophy of "write programs that do one thing and do it well" and interconnect them, being taken to the extremes that were never intended. We need a different hosting model.

In my mind the unix philosophy leads to running your cloud on your own hardware or VPS's, not this.

Re: Vercel April 2026 security incident

#226

Post by nozzlegear »

uxhacker wrote: post #151
nozzlegear wrote: post #57

Earlier quoted context omitted.

> @theo: "I have reason to believe this is credible. If you are using Vercel, it’s a good idea to roll your secrets and env vars." > @ErdalToprak: "And use your own vps or k3s cluster there’s no reason in 2026 to delegate your infra to a middle man except if you’re at AWS level needs" > @theo: "This is still a stupid take" lol, okay. Thanks for the insight, Theo, whoever you are.

What is AWS level needs?

You'll have to ask @ErdalToprak on Twitter on that one. I just thought it was funny that this slopfluencer, who's taken money to advertise Vercel, ostensibly believes that using a VPS/k3s is "a stupid take."

Re: Vercel April 2026 security incident

#227

Post by raw_anon_1111 »

uxhacker wrote: post #151
nozzlegear wrote: post #57

Earlier quoted context omitted.

> @theo: "I have reason to believe this is credible. If you are using Vercel, it’s a good idea to roll your secrets and env vars." > @ErdalToprak: "And use your own vps or k3s cluster there’s no reason in 2026 to delegate your infra to a middle man except if you’re at AWS level needs" > @theo: "This is still a stupid take" lol, okay. Thanks for the insight, Theo, whoever you are.

What is AWS level needs?

Hell doing this with fixed price AWS Lightsale based services would be better.

Re: Vercel April 2026 security incident

#228

Post by neilv »

BigTTYGothGF wrote: post #198
neilv wrote: post #175

Earlier quoted context omitted.

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

> forcing myself to use Claude Code You don't have to live like this.

Even though I'm a hardcore programmer and software engineer, I still need to at least keep aware of the latest vibe coding stuff, so I know what's good and bad about it.

Re: Vercel April 2026 security incident

#229

Post by dev360 »

nettlin wrote: post #181

They just added more details: > Indicators of compromise (IOCs) > Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations. > We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicio…

I wonder which tool that is

Re: Vercel April 2026 security incident

#230

Post by hansmayer »

nettlin wrote: post #180

They just added more details: > Indicators of compromise (IOCs) > Our investigation has revealed that the incident originated from a third-party AI tool whose Google Workspace OAuth app was the subject of a broader compromise, potentially affecting hundreds of its users across many organizations. > We are publishing the following IOC to support the wider community in the investigation and vetting of potential malicio…

[flagged]
Post reply on HN