Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

471–480 of 540 posts

Re: Vercel April 2026 security incident

#471
post #312

Earlier quoted context omitted.

I find that often the developers of these apps don't speak English, but want to target an English-speaking audience. For the marketing copy, they're using the LLM more to translate than to paraphrase, but the LLM ends up paraphrasing anyway.

> For the marketing copy, they're using the LLM more to translate than to paraphrase, but the LLM ends up paraphrasing anyway. What do you see as the distinction between "translating" and "paraphrasing"? All translations are necessarily paraphrased.

While that’s true, translations often vary in terms of how faithful they are to the source vs how idiomatic they are in the target language. Take for example the French phrase “j’ai fait une nuit blanche”, which literally means “I did a white night”. Clearly that’s a bad translation. A more natural translation might be “I pulled an all-nighter”.

Similarly, “j’ai un chat dans la gorge” probably translates best as “I’ve got a frog in my throat”, even though it’s a completely different animal, it’s an obvious mapping.

Those are fairly simple because they have neat English translations, but what about for example “C’est pas tes oignons”, which literally means “these aren’t your onions”, but is really a way of telling someone it’s none of their business. You could translate it as “it’s none of your business”, or “keep your nose out” or “stay in your lane” or lots and lots of other versions, with varying levels of paraphrasing, which depend on context you can’t necessarily read purely from the words themselves.

Re: Vercel April 2026 security incident

#472
Neon, the Vercel recommended database storage integration, doesn't use the sensitive option for the environment variables it manages including the database connection string/password and need to be rotated then deleted and manually set up as sensitive.

Re: Vercel April 2026 security incident

#473
post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

This is why Im glad I learned to code before vibecoding. I tell codex exactly what tools and platforms to use instead of letting it default to whatever is the most popular, and I guard my .env and api keys carefully. I still build things page by page or feature by feature instead of attempting to one shot everything. This should be vibe-coding 101.

Re: Vercel April 2026 security incident

#474

There are 3 main questions here: 1) Vercel rolled out sensitive secrets on February 1, 2024, why were not all existing env vars transitioned to sensitive type? Why was there any assumption that any secret added as env var before that date was still OK to be left as "non-sensitive". 2) How was actually the Google workspace account was compromised? If context.ai was the originating issue, what actually led to the takeo…

I can't comment about 1, but my read of 2 and 3 is that the chain was something like this:

1. One or more Vercel employees - likely engineers - grant OAuth access to context.ai. They presumably did this for office-suite style features, but the OAuth request included a GCP grant for some reason, maybe laziness on context.ai's part or planned future features? Either way, Google's OAuth flow has little differentiation between "office suite" scopes and "cloud platform" scopes, so this may not have been particularly obvious to those at Vercel

2. context.ai's AWS account was compromised (unspecified how), and the Google OAuth tokens they had for customer accounts, including those for at least one Vercel employee, were taken

3. Those OAuth token(s) were used to authenticate to the GCP APIs as those Vercel employees, then allowing access to Vercel's DBs, and therefore access to customer data and secrets

Re: Vercel April 2026 security incident

#475

Earlier quoted context omitted.

You have no idea how indifferent security officers can be-even when you point out critical issues. The other day, we flagged that a customer’s database had users with excessive privileges. Their only question: “Can this be exploited from the outside?” No, but most breaches today come from compromised internal accounts that are then used to break everything.

What's the problem to have local API connected in HTTP? We are within the enterprise network. And that's how I passed for a annoying "PM". With half of the program management complaining that I was slowing down things until 6m later, the head of risk management told them to get lost.

> the head of risk management told them to get lost

That's why it's important to org-chart engineer for security, if a company is really serious.

Re: Vercel April 2026 security incident

#476
This is why I moved my video streaming app (strimoza.com) to signed URLs with short expiry times for every single request. Extra complexity but at least if something leaks, the damage is contained. Curious how many people actually audit their CDN token policies before an incident forces them to.

Re: Vercel April 2026 security incident

#477

There are 3 main questions here: 1) Vercel rolled out sensitive secrets on February 1, 2024, why were not all existing env vars transitioned to sensitive type? Why was there any assumption that any secret added as env var before that date was still OK to be left as "non-sensitive". 2) How was actually the Google workspace account was compromised? If context.ai was the originating issue, what actually led to the takeo…

Taking this at face value: https://www.infostealers.com/article/breaking-vercel-breach-...

   Context.ai employee searches for Roblox exploits on web
   -> Context.ai support access breached by malware
   -> Vercel privileged employee account who uses Context.ai breached
   -> Vercel customer secrets breached
Tl;dr - insufficient endpoint protection and activity detection at Context.ai (big surprise!) + insufficient privileged account isolation at Vercel

Re: Vercel April 2026 security incident

#478
post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

This is why Im glad I learned to code before vibecoding. I tell codex exactly what tools and platforms to use instead of letting it default to whatever is the most popular, and I guard my .env and api keys carefully. I still build things page by page or feature by feature instead of attempting to one shot everything. This should be vibe-coding 101.

$ Good idea! Let's add a Redis cache to that!

Re: Vercel April 2026 security incident

#479
post #339

When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong. Vercel have had React2Shell (CVSS 10), the middleware bypass (CVSS 9.1), and now this, all within 12 months. At what point do we start asking questions about the concentration of trust in the web ecosystem? It's funny that at the engineering level we are continuously grilled in in…

You have no idea how indifferent security officers can be-even when you point out critical issues. The other day, we flagged that a customer’s database had users with excessive privileges. Their only question: “Can this be exploited from the outside?” No, but most breaches today come from compromised internal accounts that are then used to break everything.

The answer is Yes, this can be exploited from the outside by taking over dev machines and using their access.

If you answer No and complain that it’s not taken seriously, it’s at least in part because you didn’t show the risk clearly.

Re: Vercel April 2026 security incident

#480

Earlier quoted context omitted.

> For the marketing copy, they're using the LLM more to translate than to paraphrase, but the LLM ends up paraphrasing anyway. What do you see as the distinction between "translating" and "paraphrasing"? All translations are necessarily paraphrased.

While that’s true, translations often vary in terms of how faithful they are to the source vs how idiomatic they are in the target language. Take for example the French phrase “j’ai fait une nuit blanche”, which literally means “I did a white night”. Clearly that’s a bad translation. A more natural translation might be “I pulled an all-nighter”. Similarly, “j’ai un chat dans la gorge” probably translates best as “I’v…

I'll preface this by noting that I don't disagree with anything you've said, but I do have some comments:

> Similarly, “j’ai un chat dans la gorge” probably translates best as “I’ve got a frog in my throat”, even though it’s a completely different animal, it’s an obvious mapping.

Those obvious mappings can sometimes be too seductive for the translator's good. One example is that people translating English-loanwords-in-a-foreign-language into English usually can't help but translate them as the original English word.

Another example is that, in China, there is a cultural concept of a 狐狸精, which you might translate as "fox spirit". (The "fox" part of the translation is straightforward, but 精 is a term for a supernatural phenomenon, and those are difficult to translate.) They can do all kinds of things, but one especially well-known behavior is that they may take the form of human women and seduce (actual) human men. This may or may not be harmful to the man.

Because of this concept, the word also has a sense in which it may be used to insult a (normal) woman, accusing her of using her sex appeal toward harmful ends.

Chinese people translating this into English almost always use the word "vixen", which is, to be fair, a word that may refer to a sexy human woman or to a female fox. But I really don't feel that they're equivalent, or even that they have much overlap. (Unlike the situation with English loanwords, I think native speakers of Chinese are much more likely to choose this translation than native speakers of English are.)

> what about for example “C’est pas tes oignons”, which literally means “these aren’t your onions”

The form closest in structure to that would probably be "none of your beeswax", which is just a minorly altered version of "none of your business". I assume the substitution of "beeswax" is humorous and based on phonetic similarity.

As you note, there are multiple dimensions relevant to translating this and several positions you could take along each. For this particular idea, I would say the two most important dimensions are playfulness and rudeness; it's a very common idea and the language is rich in options for both.

> translations often vary in terms of how faithful they are to the source vs how idiomatic they are in the target language. Take for example the French phrase “j’ai fait une nuit blanche”, which literally means “I did a white night”. Clearly that’s a bad translation. A more natural translation might be “I pulled an all-nighter”.

This isn't what I had in mind. Here are some idiomatic translations:

I pulled an all-nighter.

I was up all night.

I didn't get any sleep.

I never got to bed.

I've been up since [something appropriate to the context].

[Something appropriate to the context] kept me up all night.

I wouldn't call any of the first four "more paraphrased" than the others. (The last two might be, if they included extra information.) If these were reports of the English speech of some other person, one of them (or less) would be a quote, and the others would be paraphrases. But as a report of French speech, they're all paraphrases. The first shares a little more grammatical structure with the French, which doesn't really mean much.

For a fairly similar example from my personal life, someone said to me 这是我第一次听说, and my spontaneous translation of it was "I've never heard that before", despite the fact that there is technically a perfectly valid English expression "this is the first I've heard of that".

What's closer to the grammatical structure of the Chinese? That's hard for me to say. You could analyze 我 as the subject of 听说, and I lean toward that analysis, but my instincts for Mandarin are weak. You might see 我 as being more strongly attached to 第一次, meaning something more like "my first time (to hear ...)" than "I hear (for the first time) ...".

But for whatever it's worth, a word by word literal gloss would be "this is me first time hear".

Between languages with less historical interaction than English and French, it's quite possible that a syntax-preserving translation of some sentence just doesn't exist.

Post reply on HN