Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

281–290 of 540 posts

Re: Vercel April 2026 security incident

#281

Post by pier25 »

deaux wrote: post #105
zuzululu wrote: post #86

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

They put a massive amount of VC cash into convincing people that Next.js was "the modern way" to create a website. Then they got lucky with the timing of LLMs becoming popular while they were the hot thing, leading LLMs to default to it when creating new websites. To picture that amount of VC cash - they're at Series F , and a huge chunk of that went towards marketing. Both have been changing as people realize it's r…

> They put a massive amount of VC cash into convincing people that Next.js was "the modern way" to create a website

My impression is Next started becoming popular mostly as a reaction against create-react-app.

Re: Vercel April 2026 security incident

#282

Post by _heimdall »

loloquwowndueo wrote: post #278
aziaziazi wrote: post #270

Earlier quoted context omitted.

The “sensitive” toggle is off by default. I’m curious about the rationale, what's the benefit of this default for users and/or Vercel? https://vercel.com/docs/environment-variables/sensitive-envi...

Sensitive environment variables are environment variables whose values are non-readable once created. So they are harder to introspect and review once set. It’s probably good practice to put non-secret-material in non-sensitive variables. (Pure speculation, I’ve never used Vercel)

I have used Vercel though prefer other hosts.

There are cases where I want env variables to be considered non-secure and fine to be read later, I have one in a current project that defines the email address used as the From address for automated emails for example.

In my opinion the lack of security should be opt-in rather than opt-out though. Meaning it should be considered secure by default with an option to make it readable.

Re: Vercel April 2026 security incident

#284

Post by glerk »

victorbjorklund wrote: post #141
zuzululu wrote: post #86

What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.

If you are using nextjs it is easier because vercel done a lot of things to make it a pain to host outside of vercel.

NextJs requires what exactly? Running a nodejs server? I mean yes, it takes a bit more time to set up than one-command deploy to Vercel. But in 2026, even this setup overhead can be cut down to minutes by telling your favorite LLM agent to SSH into your server and set it up for you.

Re: Vercel April 2026 security incident

#286

Post by throw03172019 »

aziaziazi wrote: post #270
btown wrote: post #235

Earlier quoted context omitted.

Via the incident page: > Environment variables marked as "sensitive" in Vercel are stored in a manner that prevents them from being read, and we currently do not have evidence that those values were accessed. However, if any of your environment variables contain secrets (API keys, tokens, database credentials, signing keys) that were not marked as sensitive, those values should be treated as potentially exposed and r…

The “sensitive” toggle is off by default. I’m curious about the rationale, what's the benefit of this default for users and/or Vercel? https://vercel.com/docs/environment-variables/sensitive-envi...

Simpler for vibe coders.

Re: Vercel April 2026 security incident

#287

Post by jtchang »

btown wrote: post #235
toddmorey wrote: post #73

I've been part of a response team on a security incident and I really feel for them. However, this initial communication is terrible. Something happened, we won't say what, but it was severe enough to notify law enforcement. What floors me is the only actionable advice is to "review environment variables". What should a customer even do with that advice? Make sure the variable are still there? How would you know if a…

Via the incident page: > Environment variables marked as "sensitive" in Vercel are stored in a manner that prevents them from being read, and we currently do not have evidence that those values were accessed. However, if any of your environment variables contain secrets (API keys, tokens, database credentials, signing keys) that were not marked as sensitive, those values should be treated as potentially exposed and r…

How does the app read the variable if it can't be read after you input it? Or do they mean you can't view it after providing the variable value to the UI?

Re: Vercel April 2026 security incident

#288

Post by esseph »

tcp_handshaker wrote: post #276
toddmorey wrote: post #73

I've been part of a response team on a security incident and I really feel for them. However, this initial communication is terrible. Something happened, we won't say what, but it was severe enough to notify law enforcement. What floors me is the only actionable advice is to "review environment variables". What should a customer even do with that advice? Make sure the variable are still there? How would you know if a…

Security is hard and there are only three vendors I trust: AWS, Google and IBM ( yes IBM ). Anything else is just asking for trouble.

Having worked both public and private, I can agree with this.

Google in particular has been staggeringly good, and don't sleep on IBM when they Actually Care.

Re: Vercel April 2026 security incident

#289

Post by esseph »

cleaning wrote: post #279
0xmattf wrote: post #82

Earlier quoted context omitted.

> The only reason to dramatically overpay for the hosting resources they provide is because you expect them to expertly manage security and stability. This and because it's so convenient to click some buttons and have your application running. I've stopped being lazy, though. Moved everything from Render to linode. I was paying render $50+/month. Now I'm paying $3-5. I would never use one of those hosting providers a…

If you're only paying $3-5 on Linode then your level of usage would probably be comfortably at $0 on Vercel.

Makes sense considering the quality of Vercel's security response and customer communication.

Re: Vercel April 2026 security incident

#290

Post by esseph »

lijok wrote: post #221
slopinthebag wrote: post #218

Earlier quoted context omitted.

Idk exactly how to articulate my thoughts here, perhaps someone can chime in and help. This feels like a natural consequence of the direction web development has been going for the last decade, where it's normalised to wire up many third party solutions together rather than building from more stable foundations. So many moving parts, so many potential points of failure, and as this incident has shown, you are only as…

This isn't a web development concept. It's the unix philosophy of "write programs that do one thing and do it well" and interconnect them, being taken to the extremes that were never intended. We need a different hosting model.

> We need a different hosting model.

There really isn't an option here, IMO.

1. Somebody does it

2. You do it

Much happier doing it myself tbh.

Post reply on HN