Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Vercel plugin on Claude Code wants to read your prompts

akshaychugh.xyz

Post reply on HN
Print view View original

51–60 of 120 posts

Re: The Vercel plugin on Claude Code wants to read your prompts

#51

Post by croes »

andrewqu wrote: post #39

Engineer at Vercel here who worked on the plugin! We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here: The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects…

You can’t guarantee anonymity if you also get the prompts which could contain data that breaks anonymity. With an UUID you then have an pretty personal identfier

Re: The Vercel plugin on Claude Code wants to read your prompts

#53

Post by embedding-shape »

staplers wrote: post #41
embedding-shape wrote: post #28

Earlier quoted context omitted.

Because I'm a nice person, and want to give other nice people the benefit of the doubt. And most businesses are run by people after all, not hard to imagine at least some of them would be "nice people" too. And frankly, the alternative would be too mentally taxing. So in the camp of "Good until proven otherwise" is where I remain for now.

want to give other nice people the benefit of the doubt Maybe the most naive, sheltered thing I've read on this site. If we were talking about an individual OSS maintainer, sure, that's possible. But large corporations have been doing the opposite for as long as they've existed and there's evidence presented to that fact nearly everyday.

> Maybe the most naive, sheltered thing I've read on this site

You must be new then, welcome :)

I'm not saying I never believe any individuals in a company intentionally do bad stuff, just that I require evidence of it being intention before I assume it to be intentional. Personally I don't think that's naive, and it is based on ~30-40 years of real world life experience, but I guess I'm ultimately happy that not everyone agrees on everything :)

Re: The Vercel plugin on Claude Code wants to read your prompts

#54

Post by Jare »

andrewqu wrote: post #39

Engineer at Vercel here who worked on the plugin! We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here: The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects…

> Overall our goal isn't to only collect data, it's to make the Vercel plugin amazing for building and shipping everything.

I have no idea how to read this and not go blind. The degree of contempt for your (presumably quite technical) users necessary to do this is astounding. From the article:

> That middle row. Every bash command - the full command string, not just the tool name - sent to telemetry.vercel.com. File paths, project names, env variable names, infrastructure details. Whatever’s in the command, they get it.

I don't even use Vercel in my field, but if it ever came up, it's going to be hard to undo the kind of association the name now has in my mind.

Re: The Vercel plugin on Claude Code wants to read your prompts

#55

Post by shimman »

duckmysick wrote: post #44
andrewqu wrote: post #39

Engineer at Vercel here who worked on the plugin! We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here: The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects…

Why don't have all the telemetry opt-in instead? So that nothing is collected by default and then having `VERCEL_PLUGIN_TELEMETRY=on` enables it.

Because their boss said so and they're paid the big $$$ to create not to think or push back about the damage they are doing to their users.

Re: The Vercel plugin on Claude Code wants to read your prompts

#56

Post by croemer »

andrewqu wrote: post #39

Engineer at Vercel here who worked on the plugin! We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here: The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects…

Getting a copy of all tool calls and bash prompts by default without explicit opt-in is almost certainly against GDPR.

Good luck arguing this is legitimate interest.

Update: I've verified that all bash tool calls were logged verbatim and have complained to Vercel with my device id. I'm also writing to the relevant authorities.

Re: The Vercel plugin on Claude Code wants to read your prompts

#58

Post by croes »

wswope wrote: post #42
stephantul wrote: post #40

Earlier quoted context omitted.

The idea that a random uuid == anonymous, and would protect users from having entire bash commands piped through is preposterous, and you know it.

Cmon now — I’m a rabid privacy nut but this is unfair given the context of: > Prompt telemetry is opt-in and off by default. The hook asks once; if you don't answer, session-end cleanup marks it as disabled. We don't collect prompt text unless you explicitly say yes. The UUID part is just one accessory layer, and something plenty of other players in the ecosystem don’t bother to stick to. Feels like actually botherin…

Shall I share the prompts?

No.

https://news.ycombinator.com/item?id=47357042

Re: The Vercel plugin on Claude Code wants to read your prompts

#60

Post by notpachet »

embedding-shape wrote: post #33
mbesto wrote: post #31

Earlier quoted context omitted.

> Is there any evidence of this being intentional? The evidence is in the code! If you didn't intend for a capability to be there then why is it in the code? > if they truly wanted that, they have about 10 better approaches for it, if they don't care about other things. How so? What other approaches do they have that get this much data with little potential for reputational harm? This is a very common way to create p…

> The evidence is in the code! If you didn't intend for a capability to be there then why is it in the code? Bugs happen. I won't claim to know if it was intentional or not, but usually it ends up not being intentional. > How so? What other approaches do they have that get this much data Just upload everything you find, as soon as you get invoked. Vercel has a tons of infrastructure and utilities they could execute t…

Downstream there is a post from one of the devs at Vercel (andrewqu) that built this. They say that this is by design. I think you should shift your base assumptions about the intentions of companies (and the individuals that work in them).

> Overall our goal isn't to only collect data, it's to make the Vercel plugin amazing for building and shipping everything.

Post reply on HN