Vercel April 2026 Incident Response Guide

Last updated: 20 April 2026 @ 12.07 PM AEST/Brisbane - (v2 — incorporates Vercel CEO update of 20 April)

IMPORTANT: This is not legal or official advice. If you think you have been compromised please reach out to an incident response partner. This information is offered solely as good will by the OpenSourceMalware team. If you want introductions to incident response companies we can suggest a few that we've worked with.

---

What happened?

Vercel disclosed on 19 April 2026 that an attacker gained unauthorized access to internal systems. Here is the official announcement:

On 20 April, Vercel CEO Guillermo Rauch published a detailed update confirming the initial access path: a Vercel employee used an AI platform called Context.ai, which was itself breached; from there the attacker pivoted into the employee's Google Workspace account and escalated into Vercel environments. Environment variables are encrypted at rest, but the attacker was able to enumerate variables not flagged as "sensitive." Vercel characterizes the attacker as highly sophisticated and likely AI-accelerated. Google Mandiant is engaged in the response. Vercel states Next.js, Turbopack, and their open source projects remain safe.

Here’s the important indicators of compromise section from that security advisory:

Pretty light on details. They don’t even tell you where to check for that one lone Google IOC. As a Vercel customer, I am pretty disappointed with this level of detail. Help me understand what to look for! Tell me where to go to learn if I’ve been compromised or not!

In the absence of detail from Vercel, we’ve created this document

If you run workloads on Vercel, assume the following until proven otherwise:

1. Environment variables not flagged as "sensitive" on any Vercel project in the exposure window may have been readable.
2. Any credential pushed to Vercel via the dashboard or vercel env CLI that is not rotated is a standing liability.
3. Tokens inside the Vercel ↔ GitHub and Vercel ↔ Linear integration paths may have been accessible.
4. You will not get a neat "you're affected / you're not" signal quickly. Rotate first, then investigate.

---

Known vs. claimed: keep these separate in your briefings

This distinction matters for executive comms and for not over-responding (or under-responding).

Confirmed by Vercel (bulletin + CEO update of 20 April)

• Unauthorized access to certain internal Vercel systems.
• Initial access vector: Context.ai, an AI platform used by a Vercel employee, was breached. The attacker used that foothold to compromise the employee's Vercel Google Workspace account, then escalated from there into Vercel environments.
• Customer environment variables are encrypted at rest. Variables designated "non-sensitive" were nevertheless enumerable by the attacker once inside.
• Customer impact characterized as "quite limited"; Vercel has directly contacted customers they have concerns about.
• Next.js, Turbopack, and Vercel's open source projects have been analyzed and are believed to remain safe (i.e., no malicious artifact in the release path of those projects as of Vercel's 20 April statement).
• Attacker characterized as highly sophisticated and likely significantly AI-accelerated.
• Response partners: Google Mandiant is actively engaged; external IR firms, industry peers, and law enforcement involved.
• Vercel has reached out to Context.ai to help understand the full scope.
• Vercel has shipped UI improvements: environment variable overview page, improved sensitive env var management.

Reported / attributed by third parties and the attacker (not confirmed by Vercel)

• Linear and GitHub integrations disproportionately impacted (community reporting, notably Theo Browne on X).
• Data listed for sale on BreachForums: internal DB, employee accounts, GitHub tokens, npm tokens, source code fragments, activity timestamps — offered at ~$2M.
• Actor self-identifies as ShinyHunters; other actors historically linked to that moniker have denied involvement.
• Specific customer data classes exfiltrated beyond what Vercel has confirmed directly with customers.

Treat unconfirmed reporting as plausible and actionable for your own triage, but do not cite it as fact in customer or regulator comms until Vercel corroborates it or you have independent evidence. The gap between "enumerable env vars" (confirmed by Rauch) and "npm + GitHub tokens for sale on BreachForums" (attacker claim) is the gap that matters most for supply chain risk — assume the worst for rotation purposes, stick to the confirmed version for comms.

---

Scoping: who needs to run this playbook

Highest urgency — you received direct outreach from Vercel, or any of the following apply:

• You have (or had) a Vercel ↔ GitHub integration with repository write scope.
• You have (or had) a Vercel ↔ Linear integration.
• You store unencrypted secrets (not flagged sensitive) as Vercel environment variables.
• You publish npm packages from CI/CD that runs on or through Vercel infrastructure.

Standard urgency — any team with active Vercel projects, even marketing sites. Marketing sites often hold CMS API keys, analytics tokens, and form-handler webhooks that pivot into more sensitive systems.

Still do it — even if your projects were deleted before the incident. The question is whether secrets were ever resident in Vercel in a readable form, not whether the project is still there.

Parallel question: is your org exposed to Context.ai directly?

The 20 April update names Context.ai as the breached upstream vendor. If anyone in your organization uses Context.ai independently of Vercel — for meeting intelligence, knowledge management, CRM enrichment, or any other workflow — you may have your own direct exposure window separate from the Vercel incident.

Run these checks in parallel:

• Query your SSO / IdP (Okta, Entra, Google Workspace) for any user who has authenticated to Context.ai or a Context-related OAuth app.
• Search your Google Workspace admin console → Security → OAuth app access logs for context.ai or associated app IDs.
• Check corporate expense / SaaS spend management tools for Context.ai subscriptions.
• Review which OAuth scopes were granted — Gmail read, Calendar, Drive, and Workspace directory scopes are high-impact.

If you find Context.ai usage in your environment, revoke the OAuth grants, rotate any credentials that passed through Context.ai workflows, and monitor the affected users' Google Workspace accounts for the same indicators of compromise Vercel describes seeing on their employee's account. Reach out to Context.ai directly for your own incident details; Vercel has publicly stated they're coordinating with Context to help other affected organizations.

---

Phase 0: Stop the bleeding (first 60 minutes)

Two goals: prevent new damage, preserve evidence.