Vercel Says Internal Systems Hit in Breach
250 points
3 hours ago
| 5 comments
| decipher.sc
| HN
nikcub
41 minutes ago
[-]
Claude Code defaulting to a certain set of recommended providers[0] and frameworks is making the web more homogenous and that lack of diversity is increasing the blast radius of incidents

[0] https://amplifying.ai/research/claude-code-picks/report

reply
operatingthetan
24 minutes ago
[-]
It's interesting how many of the low-effort vibecoded projects I see posted on reddit are on vercel. It's basically the default.
reply
fantasizr
12 minutes ago
[-]
next, vercel, and supabase is basically the foundation of every vibecoded project by mere suggestion.
reply
nightski
33 minutes ago
[-]
It's a good point, but I don't think the problem here is Claude. It's how you use it. We need to be guiding developers to not let Claude make decisions for them. It can help guide decisions, but ultimately one must perform the critical thinking to make sure it is the right choice. This is no different than working with any other teammate for that matter.
reply
dennisy
31 minutes ago
[-]
I think most people would agree.

However it is less clear on how to do this, people mostly take the easiest path.

reply
fintler
13 minutes ago
[-]
Its an eternal september moment.

https://en.wikipedia.org/wiki/Eternal_September

reply
stefan_
2 minutes ago
[-]
It's so trivial to seed. LLMs are basically the idiots that have fallen for all the SEO slop on Google. Did some travel planning earlier and it was telling me all about extra insurances I need and why my normal insurance doesn't cover X or Y (it does of course).
reply
andersmurphy
19 minutes ago
[-]
That's the irony of Mythos. It doesn't need to exist. LLM vibe slop has already eroded the security of your average site.
reply
btown
9 minutes ago
[-]
"Nobody ever got fired for putting their band page on MySpace."
reply
zuzululu
1 hour ago
[-]
What is the rationale for using vercel ? I'm getting a lot of value out of cloudflare with the $5/month plan lately but my bare metal box with triple digit ram has seen zero downtime since 2015.
reply
deaux
59 minutes ago
[-]
They put a massive amount of VC cash into convincing people that Next.js was "the modern way" to create a website. Then they got lucky with the timing of LLMs becoming popular while they were the hot thing, leading LLMs to default to it when creating new websites. To picture that amount of VC cash - they're at Series F, and a huge chunk of that went towards marketing.

Both have been changing as people realize it's rarely the right tool for the job, and as LLMs also become more intelligent and better at suggesting other, better options depending on what is asked for (especially Claude Opus).

reply
apsurd
20 minutes ago
[-]
I really want this to be true. nextjs is a nightmare. I'm eternally disgruntled.

nextjs is also powerful due to AI. But the value is a robust interactive front-end, easily iterated, with maybe SSR backing, nothing specific to nextjs.

So much complexity has gone into SSR. I hate 5MB client runtime just to read text as much as anyone, but not if the tradeoff is isomorphic env with magic file first-line incantations.

reply
senko
1 hour ago
[-]
You use a free template that's done in Next.js and uses its Image component, so you need a server.

Everything runs fine locally until you try to deploy it, and bam you need 4g ram machine to run the thing.

So you host it on Vercel for free cause it's easy!

Then you want to check for more than 30 seconds of analytics, and it's pay time.

reply
systemvoltage
2 minutes ago
[-]
I am not following the logic. If you’re a hobbyist, sure.

But the argument is if you’re using Vercel for production, you’re paying 5-10x what you’d pay for a VM, with 4gb.

So then what’s the rationale? You can’t be a hobbyist but also “it’s pay time” for production?

reply
kandros
4 minutes ago
[-]
For many people Vercel is Easy (not simple)

Knowing how to operate a basic server is perceived as hard and dangerous by many, especially the generation that didn’t have a chance to play with Linux for fun when growing up

reply
zoul
1 hour ago
[-]
Very nice developer experience. A lot of batteries included, like CDN, incremental page regeneration, image pipeline or observability. Not having to maintain a server.

I’m still planning to move elsewhere though, the vendor lock-in is not worth it and I’d like to keep our infra in the EU.

reply
tucnak
8 minutes ago
[-]
All of this is available in Cloudflare $5 plan?
reply
dev360
1 hour ago
[-]
For a lot of folks, I think its ease of deployment when using Next.js. I switched to astro, also doing a lot of cloudflare at the moment. Before that, I was doing OpenNext with sst.dev on AWS but it started feeling annoying.
reply
kingleopold
1 hour ago
[-]
it's free for newbies and everyone, ofc it's a trap but freemium model gets people. aws can cost easily few thousands with 2-3 mistakes and clicks. vercel makes you start free then if you grow they bill you 10x-100x aws
reply
Bridged7756
1 hour ago
[-]
I suppose their market is one click deployments. Maybe for non technical people or people not willing to deal with infra.
reply
sidcool
47 minutes ago
[-]
Can one host a Next js app on cloudflare?
reply
phpnode
45 minutes ago
[-]
reply
dennisy
27 minutes ago
[-]
Ohh this is very cool!
reply
arkits
1 hour ago
[-]
Develop experience. Ephemeral deploys. Decent observability. Decent CI options. Generous free tier.
reply
locallost
57 minutes ago
[-]
I started using it a few years ago when I moved to my current company, and have to say I've learned to like it quite a bit. Moving to Cloudflare is an option, but currently it just works so we can't be bothered. Costs are not nothing, but basically no issues with it until now, and it's not so expensive that it raises eyebrows with the biggest being that we have 3 seats. The setup is quick and again it just works. We are a very small team, and the fact we don't have to deal with it on a daily/weekly basis is valuable. Obviously this current situation is a problem, but I am not sure which platform is free of issues like these. People act like it can't happen to me, until it does.
reply
dboreham
55 minutes ago
[-]
It takes a while to realize you're being gaslit.
reply
gjsman-1000
1 hour ago
[-]
0.82% of homes are burglarized every year.

Meaning since 2015, you’ve got an 8.2% chance of having someone walk out with that box. Hopefully there’s nothing precious on it.

reply
jimberlage
1 hour ago
[-]
Assuming that all homes are at equal risk of being burglarized. In practice the neighborhoods I’ve seen are either at much higher risk or much lower risk.
reply
0123456789ABCDE
54 minutes ago
[-]
and burglarized homes have higher prob. of being burglarized again, and probabilities don't accumulate but compound, and is the server even in a house?
reply
zuzululu
21 minutes ago
[-]
I definitely do not keep it at home but the thought has crossed me for smaller less demanding boxes.
reply
FreePalestine1
1 hour ago
[-]
They didn't imply the box was at their home and that probability is off
reply
burnte
1 hour ago
[-]
If they have good backuos, no worries. Mine is in a locked colo cage in a datacenter, so I'm not worried either.
reply
loloquwowndueo
40 minutes ago
[-]
That’s not how probabilities work.
reply
operatingthetan
33 minutes ago
[-]
Imagining a thief walking in and demanding the home's RAM gave me a chuckle though.

Thieves probably look for small stuff like jewelry, cash, laptops, not some big old server.

reply
zbentley
29 minutes ago
[-]
Or burglars.
reply
0123456789ABCDE
58 minutes ago
[-]
yes, this is indeed how probability works. thanks.
reply
operatingthetan
31 minutes ago
[-]
>you’ve got an 8.2% chance of having someone walk out with that box.

The chance of being burglarized is not the same as the chance that when you are hit, they decide to take your webserver. Think it through.

reply
sdoering
2 hours ago
[-]
Dupe. Other thread with comments:

https://news.ycombinator.com/item?id=47824463

reply
adithyasrin
2 hours ago
[-]
The original link posted in the post has almost same content: https://vercel.com/kb/bulletin/vercel-april-2026-security-in...
reply
jheitzeb
1 hour ago
[-]
Missing from Glasswing
reply