Vercel closed its April 2026 incident that exposed non-sensitive environment variables
On October 16, 2026, Vercel closed its April 2026 security incident. An attacker who came in through a compromised third-party AI tool decrypted customer environment variables that were not marked sensitive. The bulletin says a later review found a small number of additional compromised accounts, plus separate compromises it says do not appear to have originated on Vercel systems.
What was reported
Vercel's April 2026 security bulletin says: "As of October 16, 2026 at 10:19 AM PST, all remediation actions related to the security incident are complete, and the incident is closed." The incident began in April 2026. The bulletin's first update is April 19, 2026, and the last entries before the October 16 closure are April 22 through April 24.
The bulletin says the incident originated with a compromise of a third-party AI tool used by a Vercel employee. The attacker used that access to take over the employee's individual Vercel Google Workspace account, then that employee's Vercel account. From there they pivoted into a Vercel environment and enumerated and decrypted non-sensitive environment variables. The bulletin describes non-sensitive variables as those that decrypt to plaintext.
It says a limited subset of customers had those variables compromised, and that Vercel told them to rotate credentials. A later review of the April 2026 incident found a small number of additional accounts that were compromised as part of this incident. The same review found a small number of customer accounts with signs of compromise that appear to be separate from the April 2026 incident. The bulletin says those do not appear to have originated on Vercel systems, and that they do not appear to be a continuation of the April incident or evidence of an earlier Vercel security incident.
In collaboration with GitHub, Microsoft, npm, and Socket, Vercel says it confirmed that no npm packages it published were compromised. The bulletin's recommendations are to enable multi-factor authentication, rotate environment variables that were not marked sensitive, including API keys, tokens, database credentials, and signing keys, and use the sensitive environment variables feature so those values are not readable the same way again. It says deleting a project or account is not enough, because a compromised secret can still reach production, so rotate secrets before deleting. It also says to review activity logs and recent deployments, set Deployment Protection to Standard at a minimum, and rotate Deployment Protection tokens if they are set.
How to prevent it
Mark every secret in Vercel as a sensitive environment variable, and rotate any API key, token, or database credential you stored as a non-sensitive one. The bulletin says non-sensitive variables decrypt to plaintext, and those were the values read in this incident.
Sources
The weekly fix
The weekly fix: 3 real security mistakes in vibe-coded apps and how to fix them, every Tuesday.
The security issues hitting Supabase, Vercel, Next.js, and Stripe apps
One short email a week, with the fix.