Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Vercel April 2026 security incident

bleepingcomputer.com

Post reply on HN
Print view View original

491–500 of 540 posts

Re: Vercel April 2026 security incident

#491

Post by fantasizr »

jongjong wrote: post #407
fantasizr wrote: post #132

Earlier quoted context omitted.

next, vercel, and supabase is basically the foundation of every vibecoded project by mere suggestion.

If this kind of vulnerability exists at the platform level, imagine how vulnerable all the vibe-coded apps are to this kind of exploit. I don't doubt the competence of the Vercel team actually and that's the point. Imagine if this happens to a top company which has their pick of the best engineers, on a global scale. My experience with modern startups is that they're essentially all vulnerable to hacks. They just don…

the vibe coders don't know what they don't know so whatever code is written on their behalf better be up to best practices (it isn't)

Re: Vercel April 2026 security incident

#492

Post by scott_w »

Orygin wrote: post #481
scott_w wrote: post #448

Earlier quoted context omitted.

You expect the CEO of a company to have the legal depth of knowledge AND knowledge of all their customers, contracts and SLAs to be able to wing a communication and not somehow trip over all of that? They also should understand every possible legal jurisdiction that could be affected? You realise even the head of their legal department (a HIGHLY competent lawyer) likely wouldn’t say there could do that without speaki…

What use is a CEO if they can't take the lead in times like this? If they are unprepared frankly they suck as CEO and should be thrown out. If only competency was a requirement for these jobs...

That’s not what I said though, is it?

Re: Vercel April 2026 security incident

#493

Post by mmastrac »

arch-choot wrote: post #376
cleaning wrote: post #279

Earlier quoted context omitted.

If you're only paying $3-5 on Linode then your level of usage would probably be comfortably at $0 on Vercel.

Repeating a prior comment I've made about this[0]: I run a rust webserver on a €4 VPS from hetzner that serves 300M (million) requests a day. From what I can figure out, Vercel charges "$0.60 per million invocations" [1], which would cost me $180 per day. [0] https://news.ycombinator.com/item?id=47611454 [1] https://vercel.com/docs/functions/usage-and-pricing#invocati...

I run a Rust webserver on a literal Pi3 in my basement and I think I managed to bench it up >1000 rps for standard loads. And that includes a bunch of tanvity querying as well.

I suspect I could do 3000+ rps with some tuning and a more modern CPU or hetzner VPS, but there's some fun cachet from running on an old Pi while there's still headroom.

Re: Vercel April 2026 security incident

#494

Post by brazukadev »

troupo wrote: post #421
brazukadev wrote: post #122

Earlier quoted context omitted.

Let's see. Roasting vercel is more popular than defending but his posts so far he seems to be defending and arguing in the replies.

Note: what follows is absolute 100% speculation based on nothing but gut feelings. Theo has long been Vercel supporter and was sponsored by them several times. In this case it could be a combination of him being genuinely interested in Vercel (a rare thing) and hopes for future sponsorships

Yes, this is exactly how I see it too minus the "genuine" part. It is because of money, and for that, he doesn't care about lying.

Re: Vercel April 2026 security incident

#495

Post by ctmnt »

An email from Vercel came to my company at 10:47am UTC. It contained little information, and said:

> At this time, we do not have reason to believe that your Vercel credentials or personal data have been compromised.

Which is not very reassuring without actual information, since presumably they would have said the same thing on Saturday, if asked.

Re: Vercel April 2026 security incident

#496

Post by jazzypants »

desecratedbody wrote: post #470
neilv wrote: post #175

Earlier quoted context omitted.

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

You wanted it to use React but not node? Am I missing something here?

You can use React without Node by using a CDN. You can even use JSX if you use Babel in a script tag. It's just inefficient and stupid as hell.

Re: Vercel April 2026 security incident

#497

Post by intrasight »

isodev wrote: post #392
Vates wrote: post #339

When one OAuth token can compromise dev tools, CI pipeline, secrets and deployment simultaneously, something architectural has gone wrong. Vercel have had React2Shell (CVSS 10), the middleware bypass (CVSS 9.1), and now this, all within 12 months. At what point do we start asking questions about the concentration of trust in the web ecosystem? It's funny that at the engineering level we are continuously grilled in in…

Coming from a company that makes infrastructure out of a view layer / vDOM library - I think anyone relying on Vercel has only themselves to blame.

That and also the CEO posting a photo of him posing with a war criminal. Using let alone relying on Vercel baffles me.

Re: Vercel April 2026 security incident

#498

Post by jazzypants »

echelon wrote: post #182
neilv wrote: post #175

Earlier quoted context omitted.

The other day, I was forcing myself to use Claude Code for a new CRUD React app[1], and by default it excreted a pile of Node JS and NPM dependencies. So I told something like, "don't use anything node at all", and it immediately rewrote it as a Python backend, and it volunteered that it was minimizing dependencies in how it did that. [1] only vibe coding as an exercise for a throwaway artifact; I'm not endorsing vib…

It emits Actix and Axum extremely well with solid support for fully AOT type checked Sqlx. Switch to vibe coding Rust backends and freeze your supply chain. Super strong types. Immaculate error handling. Clear and easy to read code. Rock solid performance. Minimal dependencies. Vibe code Rust for web work. You don't even need to know Rust. You'll osmose it over a few months using it. It's not hard at all. The "Rust i…

Cargo is just as vulnerable as NPM. It's just a smaller, more difficult target.

Re: Vercel April 2026 security incident

#500

Post by moralestapia »

intrasight wrote: post #497
isodev wrote: post #392

Earlier quoted context omitted.

Coming from a company that makes infrastructure out of a view layer / vDOM library - I think anyone relying on Vercel has only themselves to blame.

That and also the CEO posting a photo of him posing with a war criminal. Using let alone relying on Vercel baffles me.

Which one? There's so many these days I've lost track.
Post reply on HN