Vercel CEO Provides Update on Security Incident: Google Workspace Account Compromised

According to ME News, on April 20 (UTC+8), Guillermo Rauch, CEO of the frontend cloud platform Vercel, tweeted that the team is conducting a comprehensive investigation into a security incident. The incident originated when Context.ai, an AI platform used by a Vercel employee, was compromised, leading to the breach of the employee’s Vercel Google Workspace account. The attacker then performed a series of actions to gain further access to the environment. Although all customer environment variables at Vercel are fully encrypted at rest, the platform allows certain variables to be marked as “non-sensitive,” which the attacker exploited through enumeration to obtain additional access. The attacker’s speed and understanding of Vercel’s architecture exceeded expectations. The number of affected customers is currently limited. Vercel has proactively contacted impacted customers and deployed protective measures and monitoring. The team is closely collaborating with Mandiant, industry partners, and law enforcement agencies, and has conducted a full review of its supply chain—including open-source projects such as Next.js and Turbopack—to ensure security. Vercel has also rolled out a new dashboard feature to help users overview and manage their environment variables. (Source: Foresight News)