Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

401–410 of 540 posts

Re: Vercel April 2026 security incident

#401

Post by lelanthran »

jongjong wrote: post #380
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

Yes, this is a genuine problem with AI platforms. It does sometimes feel like they're suspiciously over-promoting certain solutions; to the point that it's not in the AI platform's interest. I know what it's like being on the opposite side of this as I maintain an open source project which I started almost 15 years ago and has over 6k GitHub stars. It's been thoroughly tested and battle-tested over long periods of ti…

> It's weird that clearly the LLM knows a LOT about my project and yet it never recommends it even when I design the question intentionally in such a way that it is the perfect fit.

That's literally what "weight" means - not all dependencies have the same %-multiplier to getting mentioned. Some have a larger multiplier and some have a smaller (or none) multiplier. That multiplier is literally a weight.

Re: Vercel April 2026 security incident

#402

Post by hvb2 »

steve1977 wrote: post #393
cowsup wrote: post #304

Earlier quoted context omitted.

> Still no email blast from Vercel alerting users, which is concerning. On the one hand, I get that it's a Sunday, and the CEO can't just write a mass email without approval from legal or other comms teams. But on the other hand... It's Sunday. Unless you're tuned-in to social media over the weekend, your main provider could be undergoing a meltdown while you are completely unaware. Many higher-up folks check company…

> the CEO can't just write a mass email without approval from legal or other comms teams Wouldn't the CEO be... you know... the chief executive?

Sure, and the reason he is is because he DOES check stuff like this before sending it out.

Top leaders excel because they assemble a team around them they trust. You can't do everything yourself, you need to delegate. And having people in those positions also means you shouldn't be acting alone or those people will not stick around

Re: Vercel April 2026 security incident

#403

Post by wombatpm »

gnabgib wrote: post #352
nnurmanov wrote: post #351

Earlier quoted context omitted.

Usually, companies have procedures for such events. But most do not.

Usually have procedures, but most don't? Say again

The disaster plan says there is a process, but it has never been used and is probably outdated. Chances are the social media strategy requires posting on the Facebook and updating key Circles on Google+

Re: Vercel April 2026 security incident

#404

Post by whoamii »

jongjong wrote: post #394
maxboone wrote: post #390

Earlier quoted context omitted.

You should use the subject identifiers, not the usernames. You store a mapping of provider & subject to internal users yourself. But this has been a problem in the past where people would hijack the email and create a new Google account to sign in with Google with. Similarly, when someone deletes their account with a provider, someone else can re-register it and your hash will end up the same. The subject identifiers…

Ah yeah but I wanted my platform to provide universal OAuth with any platform (that my app developer user trusts) as OAuth provider. If you rely entirely on subject identifiers; in theory, it gives one platform (OAuth provider) the ability to hijack any account belonging to users authenticating via a different platform; e.g. one platform could fake the subject identifiers of their own platform/provider to intentional…

Proprietary techniques like this are usually a good indication you’re missing something. In this case it sounds like you are missing appropriate validation of the issuer and/or token itself.

Re: Vercel April 2026 security incident

#405

Post by raw_anon_1111 »

eddythompson80 wrote: post #386
raw_anon_1111 wrote: post #350

Earlier quoted context omitted.

Well, I know that you have never heard of someone using a third party SaaS product at any major cloud provider compromising all of their customers accounts. Are you really defending Vercel as a hosting platform that anyone should take seriously?

How is any of that a defense of Vercel? If you understood how any of this works you’d know that it isn’t. Vercel is a manifestation of what’s wrong with web development, yet it has nothing to do with “creating an AWS account per user account” nor “running a reverse proxy process per user account”.

Because the same “web development” done with v0, downloaded, put in a Docker container, deployed to Lambda, with fine grain access control on the attached IAM role (all of which I’ve done) wouldn’t have that problem.

Oh and I never download random npm packages to my computer. I build and run everything locally within Docker containers

It has absolutely nothing to do with “the modern state of web development”, it’s a piss poor security posture.

Again, I know how the big boys do this…

Re: Vercel April 2026 security incident

#406

Post by steve1977 »

hvb2 wrote: post #402
steve1977 wrote: post #393

Earlier quoted context omitted.

> the CEO can't just write a mass email without approval from legal or other comms teams Wouldn't the CEO be... you know... the chief executive?

Sure, and the reason he is is because he DOES check stuff like this before sending it out. Top leaders excel because they assemble a team around them they trust. You can't do everything yourself, you need to delegate. And having people in those positions also means you shouldn't be acting alone or those people will not stick around

I disagree. In a crisis, a leader should take the lead and make decisions. If he/she is not able to that on their own, they are in the wrong place.

Now I will agree that there are many executives like the ones you describe. But they are not top leaders.

Re: Vercel April 2026 security incident

#407

Post by jongjong »

fantasizr wrote: post #132
operatingthetan wrote: post #125

Earlier quoted context omitted.

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

next, vercel, and supabase is basically the foundation of every vibecoded project by mere suggestion.

If this kind of vulnerability exists at the platform level, imagine how vulnerable all the vibe-coded apps are to this kind of exploit.

I don't doubt the competence of the Vercel team actually and that's the point. Imagine if this happens to a top company which has their pick of the best engineers, on a global scale.

My experience with modern startups is that they're essentially all vulnerable to hacks. They just don't have the time to actually verify their infra.

Also, almost all apps are over-engineered. It's impossibly difficult to secure an app with hundreds of thousands of lines of code and 20 or so engineers working on the backend code in parallel.

Some people are like "Why they didn't encrypt all this?" This is a naive way to think about it. The platform has to decrypt the tokens at some point in order to use them. The best we can do is store the tokens and roll them over frequently.

If you make the authentication system too complex, with too many layers of defense, you create a situation where users will struggle to access their own accounts... And you only get marginal security benefits anyway. Some might argue the complexity creates other kinds of vulnerabilities.

Re: Vercel April 2026 security incident

#408

Post by normie3000 »

eatery1234 wrote: post #337
adhamsalama wrote: post #260

Earlier quoted context omitted.

For $3.5, Hetzner gives 2 vCPU, 4GB RAM, 40 GB SSD, and 10 TB of bandwidth.

Pretty oversold iirc, but then again, that's the same for Linode

Do you mean these are shared instances, and the stated resources are not actually available?

Re: Vercel April 2026 security incident

#409

Post by lelanthran »

nightski wrote: post #126
0xmattf wrote: post #82

Earlier quoted context omitted.

> The only reason to dramatically overpay for the hosting resources they provide is because you expect them to expertly manage security and stability. This and because it's so convenient to click some buttons and have your application running. I've stopped being lazy, though. Moved everything from Render to linode. I was paying render $50+/month. Now I'm paying $3-5. I would never use one of those hosting providers a…

Looking at linode, those prices get you an instance with 1Gb of ram and a mediocre CPU. So you are running all of your applications on that?

> Looking at linode, those prices get you an instance with 1Gb of ram and a mediocre CPU. So you are running all of your applications on that?

I ran a LoB webapp for multiple companies on a similar setup. Turns out 1GB of RAM is insufficient to run even the most trivial Java webapps, like Jenkins, but is more than sufficient for even non-trivial things using Go + PostgreSQL.

Your stack may be slow, not the machine.

Re: Vercel April 2026 security incident

#410

Post by habinero »

kay_o wrote: post #277
habinero wrote: post #240

Earlier quoted context omitted.

I love Hank, but he has such a weird EA-shaped blind spot when it comes to AI. idgi It is true that "more diversity in code" probably means less turnkey spray-and-pray compromises, sure. Probably. It also means that the models themselves become targets. If your models start building the same generated code with the same vulnerability, how're you gonna patch that?

> start building the same generated code with the same vulnerability This situation is pretty funny to me. Some of my friends who arent technical tried vibe coding and showed me what they built and asked for feedback I noticed they were using Supabase by default, pointed out that their database was completely open with no RLS So I told them not to use Supabase in that way, and they asked the AI (various diff LLMs) to…

> The result was an API endpoint that looked like: /api/query?q=SELECT * FROM table WHERE x

Ahhhhhhhgh. If I ever make that cybersecurity house of horrors, that's going in it

Post reply on HN