Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

421–430 of 540 posts

Re: Vercel April 2026 security incident

#421

Post by troupo »

brazukadev wrote: post #122
troupo wrote: post #48

Earlier quoted context omitted.

He is "whatever gives me short-term boost in popularity". Including doing 180 turns on whatever he's evangelizing or bashing.

Let's see. Roasting vercel is more popular than defending but his posts so far he seems to be defending and arguing in the replies.

Note: what follows is absolute 100% speculation based on nothing but gut feelings.

Theo has long been Vercel supporter and was sponsored by them several times. In this case it could be a combination of him being genuinely interested in Vercel (a rare thing) and hopes for future sponsorships

Re: Vercel April 2026 security incident

#423

Post by ern »

operatingthetan wrote: post #125
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

I've done a ton of low-effort vibe-coded projects that suit my exact use cases. In many cases, I might do a quick Google search, not find an exact match, or find some bloated adware or subscription-ware and not bother going any further.

Claude Code can produce exactly what I want, quickly.

The difference is that I don't really share my projects. People who share them probably haven't realized that code has become cheap, and no one really needs/wants to see them since they can just roll their own.

Re: Vercel April 2026 security incident

#424

Post by ern »

derefr wrote: post #312
Aurornis wrote: post #189

Earlier quoted context omitted.

Reddit vibecoded LLM posts are kind of fascinating for how homogenous they are. The number of vibe coded half-finished projects posted to common subreddits daily is crazy high. It’s interesting how they all use LLMs to write their Reddit posts, too. Some of them could have drawn in some people if they took 5 minutes to type an announcement post in their own words, but they all have the same LLM style announcement pos…

I find that often the developers of these apps don't speak English, but want to target an English-speaking audience. For the marketing copy, they're using the LLM more to translate than to paraphrase, but the LLM ends up paraphrasing anyway.

I think they simply just haven't figured out that the barrier to entry is so low, that no one really cares what their app can do, even if does something genuinely useful.

Re: Vercel April 2026 security incident

#425

Post by TeMPOraL »

neilv wrote: post #175
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

My vibe coded one-off app projects have are all, by default, "self-contained single file static client side webapp, no build step, no React or other webshit nonsense" in their prompt. For more complex cases, I drop the "single file". Works like a charm.

Re: Vercel April 2026 security incident

#426

Post by eddythompson80 »

Maxious wrote: post #416
eddythompson80 wrote: post #415

Am I reading this[1] correctly that they basically had that "compromised OAuth token" for a month now and it was only detected now when the attackers posted about it in a forum? [1] https://context.ai/security-update

And that they engaged Crowdstrike for incident response... who missed OAuth tokens in the clear?

lol, yeah that Crowdstrike part was a funny CYA name drop

Re: Vercel April 2026 security incident

#427

Post by steve1977 »

scott_w wrote: post #420
steve1977 wrote: post #406

Earlier quoted context omitted.

I disagree. In a crisis, a leader should take the lead and make decisions. If he/she is not able to that on their own, they are in the wrong place. Now I will agree that there are many executives like the ones you describe. But they are not top leaders.

So you’re telling me a CEO must also be a practicing lawyer? Because any other option is how you guarantee your company gets sued into oblivion.

First of all, I would expect a top leader to be prepared for scenarios like this (including templates of customer communication).

And yeah, I would expect a CEO to have enough legal knowledge to handle such a situation (customer communication) on his own.

But I also have to mentioned that I'm not in the US. Not every country has the litigation system of the US where you can basically destroy a company because you as the customer are too dumb to not spill hot coffee over yourself.

Re: Vercel April 2026 security incident

#428

Post by steve1977 »

Maxious wrote: post #417
highphive wrote: post #396

Earlier quoted context omitted.

They can mitigate it, if the user refuses to oauth into something that asks for too much scope. Most users just click "accept" (this claim based on no data at all).

> at least one Vercel employee signed up for the AI Office Suite using their Vercel enterprise account and granted “Allow All” permissions. Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace. https://context.ai/security-update

So it's not so much a problem with OAuth itself, but with the way it was implemented here?

Re: Vercel April 2026 security incident

#429

Post by tom1337 »

pottertheotter wrote: post #299
loloquwowndueo wrote: post #193

Earlier quoted context omitted.

The actual app name would be good to have. Understandable they don’t want to throw them under the bus but it’s just delaying taking action by not revealing what app/service this was.

It’s context.ai https://x.com/rauchg/status/2045995362499076169

[dead]

Re: Vercel April 2026 security incident

#430

Post by newdee »

eddythompson80 wrote: post #415

Am I reading this[1] correctly that they basically had that "compromised OAuth token" for a month now and it was only detected now when the attackers posted about it in a forum? [1] https://context.ai/security-update

> Vercel’s internal OAuth configurations appear to have allowed this action to grant these broad permissions in Vercel’s enterprise Google Workspace.

This was an interesting tidbit too. If true, this means that Vercel’s IT/Infosec maybe didn’t bother enabling the allowlist and request/review features for OAuth apps in their Google Workspace.

On top of that, they almost certainly didn’t enable the scope limits for unchecked OAuth apps (e.g limiting it to sign-on/basic profile scopes).

Post reply on HN