Vercel#33

Amjad Masad@amasad

Many are asking if they can move their Next.js projects from Vercel to Replit? Yes! - Go to Import then GitHub - enter repo URL - Agent will take care of the rest It will set up the dev and deployment environments! For companies moving lots of work, happy to help + discount. https://t.co/DCV7AnLFXa

Guillermo Rauch@rauchg

Here's my update to the broader community about the ongoing incident investigation. I want to give you the rundown of the situation directly. A Vercel employee got compromised via the breach of an AI platform customer called https://t.co/7PY6gGtzgI that he was using. The details are being fully investigated. Through a series of maneuvers that escalated from our colleague’s compromised Vercel Google Workspace account, the attacker got further access to Vercel environments. Vercel stores all customer environment variables fully encrypted at rest. We have numerous defense-in-depth mechanisms to protect core systems and customer data. We do have a capability however to designate environment variables as “non-sensitive”. Unfortunately, the attacker got further access through their enumeration. We believe the attacking group to be highly sophisticated and, I strongly suspect, significantly accelerated by AI. They moved with surprising velocity and in-depth understanding of Vercel. At the moment, we believe the number of customers with security impact to be quite limited. We’ve reached out with utmost priority to the ones we have concerns about. All of our focus right now is on investigation, communication to customers, enhancement of security measures, and sanitization of our environments. We’ve deployed extensive protection measures and monitoring. We’ve analyzed our supply chain, ensuring Next.js, Turbopack, and our many open source projects remain safe for our community. The recommendation for all Vercel customers is to follow the Security Bulletin closely (https://t.co/BLVnic9fJC). My advice to everyone is to follow the best practices of security response: secret rotation, monitoring access to your Vercel environments and linked services, and ensuring the proper use of the sensitive env variables feature. In response to this, and to aid in the improvement of all of our customers’ security postures, we’ve already rolled out new capabilities in the dashboard, including an overview page of environment variables, and a better user interface for sensitive env var creation and management. As always, I’m totally open to your feedback. We’re working with elite cybersecurity firms, industry peers, and law enforcement. We’ve reached out to Context to assist in understanding the full scale of the incident, in an effort to protect other organizations and the broader internet. I also want to thank the Google Mandiant team for their active engagement and assistance. It’s my mission to turn this attack into the most formidable security response imaginable. It’s always been a top priority for me. Vercel employs some of the most dedicated security researchers and security-minded engineers in the world. I commit to keeping you updated and rolling out extensive improvements and defenses so you, our customers and community, can have the peace of mind that Vercel always has your back.

Guillermo Rauch@rauchg

We're introducing 𝚜𝚔𝚒𝚕𝚕𝚜 – the "npm" of AI skills. Excited to see an open, agent-agnostic ecosystem of skills flourish. To get started, try: ▲ ~/ npx skills i vercel-labs/agent-skills https://t.co/2NACKW1v8r

Lee Robinson@leerob

After 5 years, I just finished my last week at Vercel 🥲 What a ride. I'm grateful for this community and proud to have helped people learn to code with React/Next. Many tweets sent and friends made. I guess I don't have to wear all black now!? Gotta switch up my wardrobe...

fks@FredKSchott

some thoughts on eve, especially re: @flueai and the larger agent builder space. The biggest surprise: eve is vercel-only. You can't deploy it outside of vercel and it requires a full bet on their stack -- vercel runtime, vercel sandbox, vercel workflows, vercel cron jobs, etc. etc. short-term limitation, or the start of a larger "managed agents" play by vercel? eve is filesystemmaxxing. this feels specifically optimized for agents, who love the codebase consistency and have no trouble keeping track of 10+ magic file and folder conventions as the project scales to 100s of files. (^^ this is probably the most interesting design decision here. I have a ton of respect for anyone taking a big swing like this if this is intentionally optimized for agents. makes total sense.) eve has a custom-built harness. probably not interesting to most people. I'm curious if they will leverage the new ai sdk HarnessAgent concept to swap different harnesses. otherwise there's a lot of great stuff here. lots of good features. The dev-server-as-TUI is great. you can tell how much attention and care went into this. excited to see our two projects continue to explore the same space from different directions!

Chris Tate@ctatedev

Vercel is Vercel for Go, Rails, Spring Boot, Express, Laravel, .NET, FastAPI, and a web server behind nginx