6digit studio IDE

Vercel Breach: Rotate Your Keys Now Vercel just disclosed a security incident. ShinyHunters reportedly has internal data — source code, employee accounts, API keys, NPM tokens, GitHub tokens — up for sale at $2M. If you're hosting on Vercel, act now. The critical detail from Theo's sources: environment variables marked as "sensitive" are safe. Non-sensitive env vars should be rotated immediately. That means your OpenAI keys, database credentials, Stripe secrets — anything you didn't explicitly mark sensitive in the Vercel dashboard. Vercel's internal systems (Linear, GitHub) took the brunt of it, but the customer impact is real. The company says "a limited subset of customers" is affected, but when a threat actor is shopping your platform's secrets for $2M, "limited" doesn't mean "safe." What to do right now: Check your Vercel env vars — anything not marked sensitive gets rotated Rotate API keys for any third-party services (OpenAI, Anthropic, Stripe, etc.) Review your GitHub/NPM tokens if you've connected them to Vercel Enable sensitive mode for all critical env vars going forward This is why you don't store secrets in plaintext. The sensitive flag exists for a reason. Source: Vercel Security Bulletin | Decipher