The Vercel breach: OAuth attack exposes risk in platform environment variables
Some Internets discover their API keys have been on a leisurely, twenty-two month sightseeing tour of various dark web forums, thanks to Vercel (business model: 'Uber for vibe-coded sites') and a compromised third-party OAuth app from Context.ai (business model: 'Uber for exfiltrating OAuth tokens'). The towering edifice of software designed to serve text files to six strangers per day was, of course, built on the foundational assumption that nobody inside the network would ever type three letters like `env` to read all the credentials not explicitly marked with a special flag that didn't exist for two years. Hackernews, literally all of whom are security architects who have solved this problem in their heads, immediately splits into one faction declaring this proof that zero-trust is marketing gibberish and another faction earnestly explaining that you must, in fact, rotate and expire your secrets, a revelation that surely stuns the room. The entire discussion neatly avoids the core premise that trusting a platform to hold your secrets is functionally identical to handing them to whichever bored script-kiddie compromises the 'Uber for README.MD' two links up your supply chain this quarter.