Vercel Got Hacked!

ercel just announced that there was unauthorized access to certain internal Vercel systems. They said that only a limited subset of customers were affected, but did not specify who or how to check if you are a victim.

View original post on X

As a long-time user of the platform, this is not good news to wake up to.

The majority of the web apps I’ve released in the past three years or so are deployed on Vercel. I find them the easiest to use and integrate with the tools I work with every day, like GitHub or Neon.

Vercel is also the company behind Next.js, which means the blast radius of any incident involving their infrastructure reaches far beyond their own customer list.

Anyway, let’s get into the details of what happened, how serious the attack was, and how to check and recover if you are one of the victims.

What happened?

The issue broke out when a user named ShinyHunters, the group behind the Ticketmaster, Rockstar, and European Commission breaches, listed Vercel’s internal DB, employee accounts, GitHub, and NPM tokens for sale at $2 million on BreachForums.

Press enter or click to view image in full size

Vercel hacked and codes are sold online

Here’s the full context of the post:

Vercel hacked and codes are sold online

Greetings All.

Today I am selling Access Key/ Source Code/ Database From Vercel Company

Vercel Cloud

Vercel is an American cloud computing company that provides a platform for instant web application development, hosting, and deployment. The company is widely known as the creator and maintainer of Next.js, one of the most popular React-based web development frameworks. We have verified access keys for a potential global supply chain attack. We’re selling this access. Are you interested in buying it?

This is just from Linear as proof, but the access I’m about to give you includes multiple employee accounts with access to several internal deployments, API keys (including some NPM tokens and some GitHub tokens).

Give me a quote if you’re interested. This could be the largest supply chain attack ever if done right.

Vercel owns Next.js, Turbo.js, and the entire @vercel sphere. 6 million weekly downloads for Next.js alone. You send one update with a payload, and it will hit every developer on the planet who runs an installation or updates a package.

data internal user member system id name displayName email active admin guest timezone createdAt updatedAt lastSeen

Price: $2M USD

Contact XMPP: shinyc0rpsss@xmpp.jp

Telegram: @shinyc0rpsss

Email: shinysevy@tutamail.com

Middleman Required for purchase.

Updated: 19 Apr 2026

The dump attached to the listing reportedly includes 580 Vercel employee records covering names, email addresses, account status, and last-seen timestamps, according to Prism News.

Here’s why we all should care:

The hackers have NPM tokens and GitHub tokens
Vercel owns NextJS with 6 million weekly downloads
One malicious push = global supply chain attack
Vercel confirmed the breach today, April 19
They literally DMed the hackers on Telegram, asking them to stop

The timing lands right as Vercel, last valued at $9.3 billion after a $300 million Series F in September 2025, is preparing for a public offering, according to Startup Fortune.

How the hacking was done

Vercel CEO, Guillermo Rauch, quickly posted on X about what happened and how the company plans to respond to the situation.

View original post on X

Here’s what actually happened with the breach propagation.

Press enter or click to view image in full size

Vercel security breach propagation

It originated from a compromised third-party AI tool called Context.ai. An employee’s Google Workspace account was hijacked through a malicious OAuth app, allowing attackers to pivot into Vercel’s internal systems.

Initial Entry: Attackers breached Context.ai, a third-party AI platform used by a Vercel employee.
OAuth Abuse: They leveraged an OAuth token from the Context.ai app to take over the employee’s Google Workspace account.
Lateral Movement: From Workspace, the hackers gained access to internal Vercel environments and tools like Linear (project management).
Credential Harvesting: Attackers enumerated customer environment variables that were not flagged as “sensitive.”

The interesting part is what preceded all of this. According to a report from Hudson Rock, a Context.ai employee was infected with Lumma Stealer back in February 2026, a full month before the breach.

The employee’s browser history showed searches for Roblox auto-farm scripts and game exploit executors, which are some of the most common delivery vectors for Lumma malware.

That single infection dumped Google Workspace credentials, plus keys and logins for Supabase, Datadog, and Authkit. The support@context.ai account was also in the dump, which gave the attacker an easy path to escalate privileges.

Guillermo believes that the attackers had in depth understanding of their platform.

“We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel.”

This is the real risk of centralized infrastructure. One breach upstream and thousands of startups inherit it overnight.

Hours later, Context.ai released a statement confirming the security incident. The compromised OAuth tokens from their consumer platform were a result of an AWS environment breach, which enabled unauthorized access to a Vercel employee’s account.

Press enter or click to view image in full size

Context AI official statement on Vercel security breach

According to The Hacker News, the Vercel employee had signed up for Context.ai’s AI Office Suite using their enterprise Vercel account and granted “Allow All” permissions, which meant the OAuth token carried sweeping access across Vercel’s Google Workspace tenant.

Consequently, Context.ai has shut down its consumer product and is advising users to revoke the malicious OAuth app access.

I am not sure what to feel about this statement. This could well be a business-ending event, as it shows the startup cannot be trusted with the scopes customers handed to them.

The environment variable problem

One detail in Vercel’s security bulletin deserves extra attention. The attackers specifically went after environment variables that were not marked as sensitive.

Vercel’s sensitive variable feature keeps those values encrypted at rest in a way that makes them unreadable after creation. Regular environment variables, on the other hand, can be retrieved in plaintext through the dashboard or API.

Press enter or click to view image in full size

Vercel April 2026 security incident

Most developers, myself included, have not been disciplined about toggling the sensitive flag on every secret. API keys for third-party services, database URLs, analytics tokens, OpenAI keys, and Stripe test keys. Many of these end up as regular environment variables because the feature takes an extra click. That is exactly the bucket the attackers drained.

GitGuardian published a write-up urging teams to pull and scan every non-sensitive variable from their Vercel projects, treating anything that passed through that dashboard as potentially leaked.

That’s the correct mindset. If you only rotate the ones you remember were sensitive, you are probably missing secrets you forgot about.

How to check if you are affected

To check if your Google Workspace has been compromised by the same tool that compromised Vercel, do the following:

First, go to https://admin.google.com/ac/owl/list?tab=apps.

You can manually navigate to this page via: Google Admin Console > Security > Access and Data Control > API Controls > Manage app access > Accessed Apps.

Then filter by ID = http://110671459871-30f1spbu0hptbs60cb4vsmv79i7bbvqj.apps.googleusercontent.com.

This is the ID of the compromised OAuth app.

Press enter or click to view image in full size

Google Admin Console

If the search comes up empty, your workspace likely did not grant permissions to the compromised application.

If an entry appears after filtering, it means the malicious app was authorized at some point. You should immediately revoke its access and begin your incident response protocol to check for unauthorized data egress.

Pull your Google Workspace audit logs from late March through April 19 and look for unusual API calls, token refreshes from strange IP addresses, or Drive file access you cannot account for.

Also, a good time to remove apps you aren’t using or reduce permissions for apps that don’t need them.

What should you do?

First, rotate all env vars and secrets in your Vercel dashboard right now. Open the Environment Variables tab and edit the values.

Press enter or click to view image in full size

Vercel environment variables

I also encourage you to turn on the Sensitive toggle. Sensitive environment variables are non-readable once created. They help protect sensitive information stored in environment variables, such as API keys.

Press enter or click to view image in full size

Vercel environment variables

You can learn more about sensitive environment variables here.

Another thing you can do is regenerate any GitHub tokens connected through Vercel’s git integration. Pay special attention to fine-grained personal access tokens, deploy keys, and any NPM tokens your project uses for private package publishing.

Revoke API keys for Stripe, databases, and anything sitting in that dashboard. If you use Supabase, Neon, PlanetScale, Upstash, Clerk, Auth0, or any third-party service whose keys live in Vercel, treat those as leaked and reissue them.

Finally, turn on GitHub’s secret scanning and push protection if you haven’t already. It won’t catch what was already exfiltrated, but it will stop the next round of leaks from making it into your repos.

Final thoughts

To my fellow builders, I know we love vibe coding. We love hooking up AI agents to our workflows. It’s addictive. But today’s Vercel breach should snap us back to reality: “one-click OAuth” has quietly become the favorite front door for attackers.

Every time you connect Claude, Lovable, Cursor, or any agent to your Google Workspace, GitHub, or Slack, you’re handing over a key. And most of us never check what that key unlocks. Full Drive access? Repo write permissions? Email send scope?

We, humans, just click “Authorize” and move on.

Audit your connected apps weekly. Strip scopes you don’t need. Rotate tokens. Kill integrations from tools you stopped using three months ago.

Speed is great, but don’t vibe your way into a total compromise.