News for hackers. Stuff that matters.

A comment on The Vercel breach: OAuth attack exposes risk in platform environment variables. Parent comment

Re:The Vercel breach: OAuth attack exposes risk in platform ... by wouldbecouldbe on Tuesday April 21, 2026 @02:03PM (#47852212)
I mean the admin account had visibility of clients env vars, thats maybe not really great in the first place.
[ Parent | on HN ]
Re:The Vercel breach: OAuth attack exposes risk in platform ... by iririririr on Tuesday April 21, 2026 @03:05PM (#47853050)
you'd think. but this is a js dev world.

nextjs app bake all env vars on the client side code!! it's all public, unless you prefix the name with private_ or something.

[ Parent | on HN ]
Re:The Vercel breach: OAuth attack exposes risk in platform ... by rozenmd on Tuesday April 21, 2026 @03:44PM (#47853578)
This is incorrect.

You preface with PUBLIC_ to expose them in client side code.

[ Parent | on HN ]