Engineer at Vercel here who worked on the plugin! We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here: The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects…
The Vercel plugin on Claude Code wants to read your prompts
91–100 of 120 posts
Re: The Vercel plugin on Claude Code wants to read your prompts
#92Engineer at Vercel here who worked on the plugin! We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here: The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects…
Re: The Vercel plugin on Claude Code wants to read your prompts
#93Earlier quoted context omitted.
OP here, ty for your response. Few reflections: 1. Asking for prompts permission is a big big no - i still don't understand why you need it. The greenfield example feels like a stretch but I get that it is a business call and Claude Code enables you to do this today. I am just more pissed with them here. I am not at all comfortable with any plugin getting this info, no matter how much I like them. 2. The way you ask…
For sure, I can see from your perspective how some of the measures we took were a little aggressive. And we're currently working on making it more explicit. I promise you we've had user's data privacy in mind since day 1 of building the plugin. Everything we collect is only used to improve the Vercel plugin, eg: seeing when skills are being triggered too often, when certain skills are not useful, when certain context…
Re: The Vercel plugin on Claude Code wants to read your prompts
#94To be sure, the problem isn't that the plugin injects behavior into the system prompt - that's every plugin and skill, ever. But this is just such a breach of trust, especially the on-by-default telemetry that includes full bash commands. Per the OOP: > That middle row. Every bash command - the full command string, not just the tool name - sent to telemetry.vercel.com. File paths, project names, env variable names, i…
I’ll just say that as someone who was on the React team throughout these years, the drive to expand React to the server and the design iteration around it always came from within the team. Some folks went to Vercel to finish what they started with more solid backing than at Meta (Meta wasn’t investing heavily into JS on the server), but the “Vercel takeover” stories that you and others are telling are lies.
For whatever it's worth on the RSC front: I, and many others used to "if there's a wire protocol and it's meant to be open, the bytes that make up those messages should be documented" were presented with a system, at the release time of RSC, that was incredibly opaque from that perspective. There's still minimal documentation about each bundler's wire protocol. And we're all aware of companies that have done this as an intentional form of obfuscation since the dawn of networked computing - it's our open standards that have made the Internet as beautiful as it is.
But I was wrong to pin that on your team at Vercel, and I see that in the strength of your response. Intention is important, and you wanted to bring something brilliant to the world as rapidly as possible. And it is, truly, brilliant.
I should rethink how I approached all of this, and I hope that my harshness doesn't discourage you from continuing, through your writing, to be the beacon that you've been to me and countless others.
Re: The Vercel plugin on Claude Code wants to read your prompts
#95That whole company is built on sketchy practices
[flagged]
I have no idea why everyone on the internet wants to endlessly seethe about this & personally attack Guillermo for it as if he’s endorsed their foreign policy or something
Re: The Vercel plugin on Claude Code wants to read your prompts
#96Engineer at Vercel here who worked on the plugin! We have been super heads down to the initial versions of the plugin and constantly improving it. Always super happy to hear feedback and track the changes on GitHub. I want to address the notes here: The plugin is always on, once installed on an agent harness. We do not want to limit to only detected Vecel project, because we also want to help with greenfield projects…
> Overall our goal isn't to only collect data, it's to make the Vercel plugin amazing for building and shipping everything. I have no idea how to read this and not go blind. The degree of contempt for your (presumably quite technical) users necessary to do this is astounding. From the article: > That middle row. Every bash command - the full command string, not just the tool name - sent to telemetry.vercel.com. File…
Today it was the Vercel plugin but if you’re letting an LLM agent with access to bash and the internet read truly sensitive information then you’re already compromised
Re: The Vercel plugin on Claude Code wants to read your prompts
#97We're moving away from Vercel for an increasing number of reasons. But the Vercel brand has fallen so far that we're also moving away from any open source projects they have had any part in creating. The company is almost revolting.
Re: The Vercel plugin on Claude Code wants to read your prompts
#98Earlier quoted context omitted.
What does this even have to do with the thread? They're hosted there cause it's cheap and extremely easy to do so. Not because it's "specially crafted" for scams.
Easy to do because there is a lack of engineering quality similar to the attached plugin. Not surprising.
Re: The Vercel plugin on Claude Code wants to read your prompts
#99The breach of trust here, which is hard to imagine isn't intentional, is enough reason alone to stop using Vercel, and uninstall the plugin. That part is easy. Most of these agents can help you migrate if anything. The question is on whether these platforms are going to enforce their policies for plugins. For Claude Code in particular this behavior violates their plugin policy (1D) here explicitly: https://support.cl…
The age of quickly digesting and generating data, and yet the most primitive things like aligning with policies are still ignored
Re: The Vercel plugin on Claude Code wants to read your prompts
#100“We collect the native tool calls and bash commands” Holy shit, I cant imagine this to hold for every bash command Claude Code executes. That would be terrible, probably violating GDPR. (The cmd could contain email address etc) I must be wrong.