Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

481–490 of 540 posts

Re: Vercel April 2026 security incident

#481

Post by Orygin »

scott_w wrote: post #448
steve1977 wrote: post #427

Earlier quoted context omitted.

First of all, I would expect a top leader to be prepared for scenarios like this (including templates of customer communication). And yeah, I would expect a CEO to have enough legal knowledge to handle such a situation (customer communication) on his own. But I also have to mentioned that I'm not in the US. Not every country has the litigation system of the US where you can basically destroy a company because you as…

You expect the CEO of a company to have the legal depth of knowledge AND knowledge of all their customers, contracts and SLAs to be able to wing a communication and not somehow trip over all of that? They also should understand every possible legal jurisdiction that could be affected? You realise even the head of their legal department (a HIGHLY competent lawyer) likely wouldn’t say there could do that without speaki…

What use is a CEO if they can't take the lead in times like this?

If they are unprepared frankly they suck as CEO and should be thrown out. If only competency was a requirement for these jobs...

Re: Vercel April 2026 security incident

#482

Post by Orygin »

scott_w wrote: post #458
scott_w wrote: post #448

Earlier quoted context omitted.

You expect the CEO of a company to have the legal depth of knowledge AND knowledge of all their customers, contracts and SLAs to be able to wing a communication and not somehow trip over all of that? They also should understand every possible legal jurisdiction that could be affected? You realise even the head of their legal department (a HIGHLY competent lawyer) likely wouldn’t say there could do that without speaki…

Let me be more clear on what I mean by “wing it,” because “having templates” doesn’t really cut it. Anyone can bang out a “we have a problem” template, so why does the CEO need to attach their name to it? Once you’re at the point of needing a CEO to communicate, you have a specific problem, with its own specific impacts that a single person can not be expected to have enough depth of knowledge in their brain to actua…

> can not be expected to have enough depth of knowledge in their brain to actually talk about

What is the use of a CEO if not to have enough depth of knowledge about the different aspects of running a business?

Like what? Poor little CEO that doesn't understand anything about the world and how to run a company. Seems like helplessness is expected at every stage.

Re: Vercel April 2026 security incident

#483

Post by Orygin »

nightski wrote: post #126
0xmattf wrote: post #82

Earlier quoted context omitted.

> The only reason to dramatically overpay for the hosting resources they provide is because you expect them to expertly manage security and stability. This and because it's so convenient to click some buttons and have your application running. I've stopped being lazy, though. Moved everything from Render to linode. I was paying render $50+/month. Now I'm paying $3-5. I would never use one of those hosting providers a…

Looking at linode, those prices get you an instance with 1Gb of ram and a mediocre CPU. So you are running all of your applications on that?

Most of my services run with 1vCPU and 512Mb of ram. You don't need huge specs for most normal applications.

Re: Vercel April 2026 security incident

#484

Post by zbycz »

piyh wrote: post #362
Vates wrote: post #339

When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong. Vercel have had React2Shell (CVSS 10), the middleware bypass (CVSS 9.1), and now this, all within 12 months. At what point do we start asking questions about the concentration of trust in the web ecosystem? It's funny that at the engineering level we are continuously grilled in in…

JavaScript living only as a built artifact in an s3 bucket makes for a much simpler life.

until someone starts a botnet making your S3 invoice to $10k. Pay per usage is always a liability.

It is horrendous that aws doesnt allow any usage limits.

Re: Vercel April 2026 security incident

#485

Post by michaelbuckbee »

operatingthetan wrote: post #125
nikcub wrote: post #116

Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents [0] https://amplifying.ai/research/claude-code-picks/report

It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.

There's a push and pull here, Typescript + React + Vercel are also very amenable to LLM driven development due to a mix of the popularity of examples in the LLMs dataset, how cheap the deployment is and how quick the ecosystem is to get going.

Re: Vercel April 2026 security incident

#486

Post by scott_w »

Orygin wrote: post #482
scott_w wrote: post #458

Earlier quoted context omitted.

Let me be more clear on what I mean by “wing it,” because “having templates” doesn’t really cut it. Anyone can bang out a “we have a problem” template, so why does the CEO need to attach their name to it? Once you’re at the point of needing a CEO to communicate, you have a specific problem, with its own specific impacts that a single person can not be expected to have enough depth of knowledge in their brain to actua…

> can not be expected to have enough depth of knowledge in their brain to actually talk about What is the use of a CEO if not to have enough depth of knowledge about the different aspects of running a business? Like what? Poor little CEO that doesn't understand anything about the world and how to run a company. Seems like helplessness is expected at every stage.

> What is the use of a CEO if not to have enough depth of knowledge about the different aspects of running a business?

Bit of a difference between “having depth of knowledge in their business” and “can speak off-the-cuff with the necessary accuracy to remain in compliance with every contract and legal jurisdiction their organisation is engaged in, without consulting the numerous domain experts they employ for just this purpose,” isn’t there.

Also, such a situation that requires the CEO’s direct attention has already gone FAR beyond your standard incidents where you can throw out a pre written statement. Do you want your organisation just cuffing it from the top down? Are you Elon Musk in disguise?

Re: Vercel April 2026 security incident

#487

Post by 0xmattf »

somewhatgoated wrote: post #315
0xmattf wrote: post #292

Earlier quoted context omitted.

It could be $0 on Render too, but then there's going to be a 3 minute load time for a landing page to become visible, lol. So if you don't want your server to sleep, you're going to have to pay $20/month. Does Vercel do the same?

No, I run several small websites on Vercel for free for years, always served static pages very quickly

Static pages, sure. But what do you do if you want a contact form or something? Yeah, you can use services like formspree, but then you may end up paying $20/month for that alone. Perhaps I'm just ignorant.

Re: Vercel April 2026 security incident

#488

Post by aziaziazi »

throw03172019 wrote: post #286
aziaziazi wrote: post #270

Earlier quoted context omitted.

The “sensitive” toggle is off by default. I’m curious about the rationale, what's the benefit of this default for users and/or Vercel? https://vercel.com/docs/environment-variables/sensitive-envi...

Simpler for vibe coders.

Ok but it's not the original intent: that default exists since at least 2020: https://web.archive.org/web/20201130022511/https://vercel.co...

Re: Vercel April 2026 security incident

#489

Post by 0xmattf »

anurag wrote: post #333
somewhatgoated wrote: post #315

Earlier quoted context omitted.

No, I run several small websites on Vercel for free for years, always served static pages very quickly

Render offers free static sites that are served via a CDN and load instantly: https://render.com/docs/static-sites

When I said landing page, I had contact forms and more in mind, not documentation sites.

But that is news to me. Interesting. Although for static sites, I always use Netlify or even GitHub pages.

Re: Vercel April 2026 security incident

#490

Post by pier25 »

eddythompson80 wrote: post #415

Am I reading this[1] correctly that they basically had that "compromised OAuth token" for a month now and it was only detected now when the attackers posted about it in a forum? [1] https://context.ai/security-update

A month? If true this is insane.
Post reply on HN