Vercel closed its April 2026 incident that exposed non-sensitive environment variables
On October 16, 2026, Vercel closed its April 2026 security incident. An attacker who came in through a compromised third-party AI tool decrypted customer environment variables that were not marked sensitive. The bulletin says a later review found a small number of additional compromised accounts, plus separate compromises it says do not appear to have originated on Vercel systems.