Finally got an email from Vercel saying that my account probably isn't compromised.
7:57 AM Monday, April 20, 2026 Coordinated Universal Time (UTC)
Vercel April 2026 security incident
441–450 of 540 posts
Re: Vercel April 2026 security incident
#442Earlier quoted context omitted.
So you’re telling me a CEO must also be a practicing lawyer? Because any other option is how you guarantee your company gets sued into oblivion.
First of all, I would expect a top leader to be prepared for scenarios like this (including templates of customer communication). And yeah, I would expect a CEO to have enough legal knowledge to handle such a situation (customer communication) on his own. But I also have to mentioned that I'm not in the US. Not every country has the litigation system of the US where you can basically destroy a company because you as…
> you as the customer are too dumb to not spill hot coffee over yourself
presuming you're referring to the hot coffee lawsuit, maybe read details of the story. McDonalds wasn't at all blameless, and the plaintiff had reasonable demands
Re: Vercel April 2026 security incident
#443Earlier quoted context omitted.
It's a good point, but I don't think the problem here is Claude. It's how you use it. We need to be guiding developers to not let Claude make decisions for them. It can help guide decisions, but ultimately one must perform the critical thinking to make sure it is the right choice. This is no different than working with any other teammate for that matter.
Shouldn’t Claude just refuse to make decisions, then, if it is problematic for it to do so? We’re talking about a trillion dollar company here, not a new grad with stars in their eyes
It's just an LLM.
Re: Vercel April 2026 security incident
#444Earlier quoted context omitted.
New one coming in 5 years. Cycle repeats itself.
I don't think so, AIs are going to freeze the tooling to what we have today since that's what's in the training corpus, and it's self reinforcing.
Nah, the good LLMs can generally web search and read documentation well enough that the fact that pre-training isn’t up to the minute is not a serious concern. Badly-documented projects are more of a concern, but they weren’t likely to get much pre-AI usage either.
Re: Vercel April 2026 security incident
#445Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report
It's a good point, but I don't think the problem here is Claude. It's how you use it. We need to be guiding developers to not let Claude make decisions for them. It can help guide decisions, but ultimately one must perform the critical thinking to make sure it is the right choice. This is no different than working with any other teammate for that matter.
That's not helped by a recent change to their system prompt "acting_vs_clarifying":
> When a request leaves minor details unspecified, the person typically wants Claude to make a reasonable attempt now, not to be interviewed first. Claude only asks upfront when the request is genuinely unanswerable without the missing information (e.g., it references an attachment that isn’t there).
> When a tool is available that could resolve the ambiguity or supply the missing information — searching, looking up the person’s location, checking a calendar, discovering available capabilities — Claude calls the tool to try and solve the ambiguity before asking the person. Acting with tools is preferred over asking the person to do the lookup themselves.
> Once Claude starts on a task, Claude sees it through to a complete answer rather than stopping partway. [...]
In my experience before this change. Claude would stop, give me a few options and 70% of the time I would give it an unlisted option that was better. It actually would genuinely identify parts of the specs that were ambiguous and needed to be better defined. With the new change, Claude plows ahead making a stupid decision and the result is much worse for it.
Re: Vercel April 2026 security incident
#446Earlier quoted context omitted.
I guess engineers can differentiate their vibecoded projects by selecting an eccentric stack.
Choosing an eccentric stack makes the llms do better even. Like Effect.ts or Elixir
That's been my experience as well. Claude code does better with Elixir (plus I enjoy working on the code better after :) )
Re: Vercel April 2026 security incident
#447[flagged]
I'm not super savvy with OAuth, but shouldn't scopes prevent issues like this? https://oauth.net/2/scope/
From what I understood at [1], Context.ai users "enable AI agents to perform actions across their external applications, facilitated via another 3rd-party service." I.e., it's designed to get someone's OAuth token and use it. Unless that is done really carefully, the risks are as high as the user's authorization goes. The danger doesn't only come from leaks, but also from agents, that can clear your db or directory at a whim.
Re: Vercel April 2026 security incident
#448Earlier quoted context omitted.
So you’re telling me a CEO must also be a practicing lawyer? Because any other option is how you guarantee your company gets sued into oblivion.
First of all, I would expect a top leader to be prepared for scenarios like this (including templates of customer communication). And yeah, I would expect a CEO to have enough legal knowledge to handle such a situation (customer communication) on his own. But I also have to mentioned that I'm not in the US. Not every country has the litigation system of the US where you can basically destroy a company because you as…
You expect the CEO of a company to have the legal depth of knowledge AND knowledge of all their customers, contracts and SLAs to be able to wing a communication and not somehow trip over all of that? They also should understand every possible legal jurisdiction that could be affected? You realise even the head of their legal department (a HIGHLY competent lawyer) likely wouldn’t say there could do that without speaking to the key people in their team?
Should the CEO also bang out some dev estimates for the roadmap because, hey, they should be competent enough to do something like that. Why not submit the accounts for the year? How hard can it be, just reading a few lines off their Sage or Quickbooks accounts?
Re: Vercel April 2026 security incident
#449Earlier quoted context omitted.
Choosing an eccentric stack makes the llms do better even. Like Effect.ts or Elixir
I actually noticed the same. Having it work on Mithril.js instead of React seems (I know it's all just kind of hearsay) to generate a lot cleaner code. Maybe it's just because I know and like Mithril better, but also is likely because of the project ethos and it's being used by people who really want to use Mithril in the wild. I've seen the same for other slightly more exotic stacks like bottle vs flask, and telling…
That makes sense. There's less training data but it is better training data. LLMs were trained on really bad pandas code, so they're really really good at generating bad pandas. Elixer, there's less of it, but what there is, is higher quality, so then what it outputs is off higher quality too.
Re: Vercel April 2026 security incident
#450Earlier quoted context omitted.
Ah yeah but I wanted my platform to provide universal OAuth with any platform (that my app developer user trusts) as OAuth provider. If you rely entirely on subject identifiers; in theory, it gives one platform (OAuth provider) the ability to hijack any account belonging to users authenticating via a different platform; e.g. one platform could fake the subject identifiers of their own platform/provider to intentional…
Proprietary techniques like this are usually a good indication you’re missing something. In this case it sounds like you are missing appropriate validation of the issuer and/or token itself.
I want to support OAuth2, not OpenID so I don't rely on a JWT; I call the issuer's endpoint directly from my backend using their official domain name over HTTPS. I use the sub field to avoid re-allocation of usernames/emails but my point is that I don't trust it on its own; I couple it with the provider ID.
To make it universal, I had to keep complexity minimal and focus on the most supported protocol which is plain OAuth2.