News for hackers. Stuff that matters.
Re:Vercel April 2026 security incident by MattIPv4 on Sunday April 19, 2026 @10:39AM (#47824655)
Related: https://news.ycombinator.com/item?id=47824426

https://x.com/theo/status/2045862972342313374

> I have reason to believe this is credible.

https://x.com/theo/status/2045870216555499636

> Env vars marked as sensitive are safe. Ones NOT marked as sensitive should be rolled out of precaution

https://x.com/theo/status/2045871215705747965

> Everything I know about this hack suggests it could happen to any host

https://x.com/DiffeKey/status/2045813085408051670

> Vercel has reportedly been breached by ShinyHunters.

Re:Vercel April 2026 security incident by otterley on Sunday April 19, 2026 @11:48AM (#47825163)
Who is this “theo” person and why are multiple people quoting him? He seems to have little to say that’s substantive at this point.
Re:Vercel April 2026 security incident by koito17 on Sunday April 19, 2026 @12:16PM (#47825378)
> He seems to have little to say that’s substantive

That's because he's an e-celeb. His goal is to generate impressions (and advertisement revenue) on social media. It just happens that he chooses software-adjacent topics.

Re:Vercel April 2026 security incident by MikeNotThePope on Sunday April 19, 2026 @11:55AM (#47825228)
Theo Browne is a reasonably well known YouTuber & YC founder.

https://t3.gg/

Re:Vercel April 2026 security incident by gordonhart on Sunday April 19, 2026 @11:56AM (#47825238)
He’s a tech influencer, probably getting quoted here because he has the biggest reach of people covering this so far.
Re:Vercel April 2026 security incident by reactordev on Sunday April 19, 2026 @12:35PM (#47825516)
YT tech vlogger
Re:Vercel April 2026 security incident by nothinkjustai on Sunday April 19, 2026 @01:05PM (#47825771)
He is a paid Vercel shill (literally, he does sponsored content for them on his YouTube channel)
Re:Vercel April 2026 security incident by TiredOfLife on Sunday April 19, 2026 @02:59PM (#47826681)
Re:Vercel April 2026 security incident by djeastm on Sunday April 19, 2026 @05:55PM (#47827978)
Not in a few years.
Re:Vercel April 2026 security incident by Aurornis on Sunday April 19, 2026 @03:37PM (#47826996)
He’s a streamer who talks about tech. Previously had a sponsorship relationship with Vercel so is theoretically more well connected than average on the topic. He’s also very divisive because he does a lot of ragebait, grievance reporting, and contrarian takes but famously has blind spots for a few companies and technologies that he’s favored in past videos or been sponsored by. I have friends who watch a lot of his videos but I’ve never been able to get into it.
Re:Vercel April 2026 security incident by tom1337 on Sunday April 19, 2026 @03:31PM (#47826939)
> Ones NOT marked as sensitive should be rolled out of precaution

if it's not marked as sensitive (because it is not sensitive) there is no reason to roll them. if you must roll a insensitive env var it should've been sensitive in the first place, no?

Re:Vercel April 2026 security incident by jackconsidine on Sunday April 19, 2026 @04:55PM (#47827564)
There's a difference between sensitive, private and public. If public (i.e. NEXT_PUBLIC_) then yeah likely not a reason to roll. Private keys that aren't explicitly sensitive probably are still sensitive. It doesn't seem to be the default to have things "sensitive" and I can't tell if that's a new classification or has always been there.

I can imagine the reason why an env variable would be sensitive, but need to be re-read at some point. But overwhelmingly it makes sense for the default to be set, and never access again (i.e. Fly env values, GCP secret manager etc)